Tag: nexshield

1 Attack Reports | 0 Vulnerabilities

Attack reports

Dissecting CrashFix: A New Toy

KongTuke, a threat actor tracked since 2025, has launched a new campaign using a malicious browser extension called NexShield that impersonates uBlock Origin Lite. The extension causes browser crashes and displays fake security warnings to trick users into executing malicious commands. The campaign…
obfuscation
rat
social engineering
anti-analysis
dga
browser extension
enterprise targeting
fingerprinting
2026-01-17
crashfix
modelorat
nexshield
Published: January 17, 2026
Downloadable IOCs: 10
Click here to see more Attack Reports