Full Report
Fake ad blocker crashes your browser, then offers a "fix." Go inside KongTuke's CrashFix campaign, from malicious extension to ModeloRAT for VIP targets.
Analysis Summary
# Threat Actor: KongTuke
## Attribution & Identity
**KongTuke** is a threat actor identified and tracked by security researchers (Huntress) since early 2025. The actor is characterized by their use of sophisticated social engineering techniques and the development of custom malware. In recent campaigns, the actor has utilized the developer email **alaynna6899[@]gmail.com** for malicious browser extensions.
## Activity Summary
In January 2026, KongTuke launched the **"CrashFix"** campaign. The operation begins with malvertising that leads users to a malicious Chrome extension named **NexShield** (a clone of uBlock Origin Lite) hosted on the official Chrome Web Store. Once installed, the extension intentionally crashes the browser and displays a fake security alert. The user is then tricked into executing a PowerShell command via the Windows Run dialog, leading to the deployment of **ModeloRAT** or other payloads.
## Tactics, Techniques & Procedures
- **Malvertising:** Utilizing Google Search ads to direct users to malicious Chrome Web Store listings.
- **Brand Impersonation:** Cloning legitimate extensions (uBlock Origin Lite) and impersonating well-known developers (Raymond Hill).
- **Social Engineering (ClickFix/CrashFix):** Using fake browser error messages ("browser stopped abnormally") to induce panic.
- **Clipboard Hijacking:** Silently copying malicious PowerShell code to the user's clipboard to be executed manually by the victim via `Win + R` and `Ctrl + V`.
- **Environment Awareness:** The infection chain branches based on whether the host is domain-joined or a standalone workstation.
- **Persistence:** Implementation of a Python-based RAT for long-term access.
**MITRE ATT&CK IDs:**
- **T1566.002:** Phishing: Malvertising
- **T1204.002:** User Execution: Malicious File
- **T1059.001:** Command and Scripting Interpreter: PowerShell
- **T1123:** Browser Extensions
- **T1041:** Exfiltration Over C2 Channel
## Targeting
- **Sectors:** Primarily focused on **Enterprise/Corporate networks** to gain access to Active Directory and internal systems.
- **Geography:** Global (implied by the use of the Chrome Web Store and English-language social engineering).
- **Victims:** Specifically targets **domain-joined hosts** for high-value operations; standalone home users are currently served a "test" payload.
## Tools & Infrastructure
- **NexShield:** A malicious browser extension impersonating uBlock Origin Lite.
- **ModeloRAT:** A previously undocumented Python-based Remote Access Trojan (RAT) reserved for VIP/enterprise targets.
- **CrashFix:** A variant of the ClickFix social engineering kit designed to freeze the browser.
- **Malicious URL:** `hxxps[://]chromewebstore[.]google[.]com/detail/nexshield-%E2%80%93-advanced-web/cpcdkmjddocikjdkbbeiaafnpdbdafmi`
- **Developer Email:** `alaynna6899[@]gmail.com`
- **Reference URL (Fake):** `hxxps[://]github[.]com/uBlockOrigin/uBOL-home` (Note: The actor uses this for spoofing; the real repo is legitimate).
## Implications
KongTuke demonstrates a high level of operational maturity by leveraging the inherent trust in the official Chrome Web Store. By intentionally crashing the browser, they create a "problem" for which they provide the "solution," significantly increasing the likelihood of user compliance. The shift toward targeting domain-joined machines specifically indicates an objective of corporate espionage, ransomware deployment, or significant lateral movement within enterprise environments.
## Mitigations
- **Application Control:** Restrict the installation of browser extensions to a pre-approved "allow-list" via Group Policy (GPO) or MDM.
- **User Awareness:** Train employees to recognize "ClickFix" tactics; emphasize that legitimate browser repairs never require manual execution of PowerShell commands via the Run dialog.
- **Endpoint Detection:** Monitor for `powershell.exe` processes spawned with suspicious encoded commands or those originating from unexpected manual user input (e.g., Run dialog).
- **Network Filtering:** Block known malicious developer accounts and monitor for unusual traffic to unknown C2 IPs associated with Python-based scripts.