Loading story…
The CrashFix campaign is delivering the Python-based ModeloRAT remote-access trojan to Windows enterprise environments, selectively targeting domain-joined hosts. Victims are lured through a malicious Chrome extension named NexShield, which exhausts browser resources and displays a fraudulent repair prompt. The prompt induces users to execute a clipboard-delivered command; the infection chain then abuses finger.exe to retrieve and launch a PowerShell stage.
The PowerShell loader performs anti-analysis and domain-membership checks before downloading a portable WinPython environment and ModeloRAT. The implant establishes persistence through an HKCU\Run registry key and communicates with hardcoded C2 servers over HTTP/port 80 using RC4-encrypted, zlib-compressed JSON and adaptive beaconing. Its operator commands support host reconnaissance, remote code execution, payload deployment, self-updates, and removal, creating a material risk of hands-on-keyboard activity, lateral movement, and Active Directory compromise.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ModeloRAT, a Python-based Windows remote-access trojan targeting enterprise domain-joined systems, was first observed.
The CrashFix campaign uses a malicious Chrome extension presented as NexShield/“Smart Ad Blocker” to exhaust browser resources, display a fake repair alert, and trick victims into executing a clipboard-delivered command. The chain selectively downloads ModeloRAT and a portable WinPython environment after identifying a domain-joined host.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcepicussecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026
Elastic Security Labs identified an active ClickFix campaign that compromises legitimate websites, including `bincheck.io` and `investonline.in`, to display multilingual fake Cloudflare verification prompts. The lure copies an obfuscated PowerShell command to a visitor’s clipboard and relies on the victim manually executing it, initiating a five-stage infection chain that delivers the custom native C++ remote-access trojan **MIMICRAT**. The PowerShell stages use runtime obfuscation and attempt to disable Windows Event Tracing for Windows (ETW) logging and AMSI scanning before a Lua-based loader decrypts and runs shellcode in memory. MIMICRAT uses malleable HTTPS command-and-control and enables file and process operations, token theft and impersonation, shellcode injection, interactive shells, and SOCKS5 tunneling; the campaign remained active when reported.
Sep 9, 2026
An active malware campaign is using **ClickFix** fake CAPTCHA pages to trick users into pasting and running malicious PowerShell commands. The infection chain deploys GHOSTPULSE—also known as **HijackLoader** or IDATLOADER—using DLL sideloading, followed by a .NET intermediary that decrypts and reflectively loads the ARECHCLIENT2/SectopRAT remote-access trojan directly into memory. The deceptive CAPTCHA pages were hosted on client subdomains of `dealeronlinemarketing.com` and `contology.com`, which researchers assess were likely enabled by the compromise of server `50.57.243[.]90`. ARECHCLIENT2 bypasses AMSI, profiles infected systems, steals credentials, browser data, and cryptocurrency-wallet information, and receives commands from rotating command-and-control infrastructure. SectopRAT is a .NET-based RAT with a history of anti-analysis protections, including ConfuserEx control-flow obfuscation and anti-tamper measures; its deployment through reflective loading further reduces disk-based detection opportunities. Organizations should prioritize user awareness of fake CAPTCHA copy-and-paste prompts and detect anomalous PowerShell execution, DLL sideloading, and in-memory .NET loading behavior.
Sep 9, 2026