Executive Summary

Researchers at Huntress have uncovered an inventive malware campaign named "CrashFix," orchestrated by a threat group they call KongTuke. The attack uses a malicious Google Chrome extension, "NexShield," which masquerades as a popular ad blocker. The extension deliberately causes the browser to crash and then displays a fake error message. This message socially engineers the user into executing a PowerShell command, which it has covertly copied to their clipboard. This action leads to the installation of a new Python-based RAT, ModeloRAT, with a focus on targeting corporate environments.

Threat Overview

The CrashFix campaign is a multi-stage attack that cleverly blends technical manipulation with social engineering. It was distributed via the official Chrome Web Store, highlighting the ongoing challenge of keeping malicious extensions out of trusted marketplaces. The attack's focus on systems joined to a corporate domain suggests its goal is corporate espionage or initial access for larger attacks, such as ransomware.

Technical Analysis

The attack chain is highly structured:

1. Initial Access: A user installs the malicious "NexShield – Advanced Web Protection" extension from the Chrome Web Store, believing it to be 'uBlock Origin Lite' (T1176 - Browser Extensions).
2. Defense Evasion & Impact: The extension waits for 60 minutes using the Alarms API to evade immediate detection. It then initiates a local denial-of-service attack by creating an endless loop of port connections, causing the browser to crash (T1499 - Endpoint Denial of Service).
3. Execution via Social Engineering: Upon browser restart, a fake "CrashFix" pop-up appears. Simultaneously, the extension uses the Clipboard API to silently copy a malicious PowerShell command to the user's clipboard (T1115 - Clipboard Data). The user is instructed to paste and run this command in the Windows Run dialog to "fix" the issue (T1204.002 - Malicious File).
4. Payload Staging: The executed PowerShell command uses a living-off-the-land binary (LOLBAS), Finger.exe, to connect to a remote server (nexsnield[.]com) and retrieve the next stage payload (T1218 - System Binary Proxy Execution).
5. Payload Deployment: The final payload, the Python-based ModeloRAT, is installed, giving the attackers remote access to the compromised system.

Impact Assessment

A successful infection results in the installation of a remote access trojan, giving the KongTuke group full control over the victim's machine. As the attack targets domain-joined systems, this provides a critical foothold within a corporate network. From here, attackers can steal data, harvest credentials for Active Directory, move laterally to other systems, and deploy further malware like ransomware. The novel use of a browser crash as a social engineering lure is particularly effective, as users are more likely to trust instructions that appear to be part of a legitimate troubleshooting process.

IOCs

Cyber Observables for Detection

Detection & Response

• LOLBAS Monitoring: Monitor for the execution of unusual living-off-the-land binaries like finger.exe. An EDR rule that alerts on finger.exe making any network connection would be a high-fidelity indicator for this attack.
• PowerShell Logging: Enable PowerShell Script Block Logging (Event ID 4104) to capture the content of executed scripts, which would reveal the malicious commands used in this campaign.
• D3FEND: User Behavior Analysis (D3-UBA): Analyze user behavior for anomalies, such as a user pasting a long, obfuscated command into a Run or PowerShell prompt shortly after a browser crash.

Mitigation

• Restrict Browser Extensions: Use browser management policies (e.g., Chrome Enterprise policies) to create an allowlist of approved extensions and block users from installing any others.
• User Training: Educate users on social engineering tactics. Specifically, train them to be highly suspicious of any pop-up that instructs them to manually run commands, especially after a crash.
• Block LOLBAS: If not required for business, consider using application control to block the execution of rarely used LOLBAS like finger.exe.