Full Report
Fake ad blocker crashes your browser, then offers a "fix." Go inside KongTuke's CrashFix campaign, from malicious extension to ModeloRAT for VIP targets.
Analysis Summary
# Threat Actor: KongTuke
## Attribution & Identity
**KongTuke** is a threat actor first identified and tracked by security researchers (Huntress) at the beginning of 2025. The actor is characterized by their use of social engineering via malicious browser extensions and "ClickFix" style evolution.
* **Known Aliases:** Associated with the "CrashFix" campaign.
* **Associated Developer Accounts:** alaynna6899[@]gmail.com (registered developer for malicious Chrome extensions).
* **Identity Notes:** The actor demonstrates a specific interest in differentiating between home users and corporate (domain-joined) environments, indicating a high level of operational maturity.
## Activity Summary
In early 2026, KongTuke launched a campaign dubbed **CrashFix**. This operation utilizes malvertising to drive users to the official Chrome Web Store to download a malicious extension called **NexShield**. Once installed, the extension intentionally crashes the victim's browser and presents a fake repair utility. This utility baits users into executing malicious PowerShell commands via a clipboard-hijacking social engineering tactic.
## Tactics, Techniques & Procedures
* **Malvertising:** Purchasing ads in search results for popular software (e.g., ad blockers) to redirect users to malicious landing pages.
* **Typosquatting/Impersonation:** Impersonating legitimate open-source projects (uBlock Origin Lite) and developers (Raymond Hill) to gain trust.
* **Living-off-the-Land (LotL):** Instructing victims to use the Windows Run dialog (Win + R) to execute commands, bypassing traditional file-based detection.
* **Clipboard Hijacking:** The extension silently replaces the user’s clipboard content with a malicious PowerShell string once the "scan" is initiated.
* **Social Engineering (ClickFix/CrashFix):** Using fake browser error messages ("browser stopped abnormally") to create a sense of urgency.
* **Conditional Execution:** The infection chain changes based on whether the host is domain-joined (VIP target) or a standalone workstation (test/lower priority).
**MITRE ATT&CK IDs:**
* **T1583.008:** Malvertising
* **T1176:** Browser Extensions
* **T1204.002:** User Execution: Malicious Link/Command
* **T1059.001:** Command and Scripting Interpreter: PowerShell
* **T1115:** Clipboard Data
## Targeting
* **Sectors:** Primarily focused on corporate/enterprise environments.
* **Geography:** Global (based on Chrome Web Store distribution).
* **Victims:** Specifically seeking **Domain-Joined hosts** to facilitate access to Active Directory and lateral movement. Standalone "home" users appear to be lower priority or used for testing.
## Tools & Infrastructure
* **NexShield:** A malicious browser extension that clones the legitimate "uBlock Origin Lite."
* **ModeloRAT:** A previously undocumented Python-based Remote Access Trojan (RAT) reserved exclusively for VIP (domain-joined) targets.
* **Infrastructure:**
* Chrome Web Store (Distribution): `hxxps[://]chromewebstore[.]google[.]com/detail/nexshield-%E2%80%93-advanced-web/cpcdkmjddocikjdkbbeiaafnpdbdafmi`
* Fake Developer Email: `alaynna6899[@]gmail.com`
* Legitimate Project Mimicry: `hxxps[://]github[.]com/uBlockOrigin/uBOL-home` (referenced to add legitimacy).
## Implications
KongTuke represents an evolving threat that successfully bypasses the "secure" reputation of the official Chrome Web Store. By moving from general browser hijacking to specialized, domain-aware malware like ModeloRAT, the group has transitioned from a nuisance-level actor to a significant enterprise threat capable of facilitating ransomware deployment or data exfiltration via Active Directory compromise.
## Mitigations
* **Extension Whitelisting:** Implement Group Policy Objects (GPO) to restrict browser extensions to a pre-approved list in corporate environments.
* **User Training:** Educate employees on "ClickFix" tactics; emphasize that legitimate browser repairs never require pasting commands into the Windows Run dialog.
* **Endpoint Monitoring:** Monitor for suspicious PowerShell execution involving `clipboard` commands or network connections originating from Python-based binaries (ModeloRAT).
* **Ad-Blocking at Network Level:** Use DNS-level filtering to block known malvertising domains before they reach the endpoint.