CrashFix: The Next Evolution of ClickFix Browser Extension Tradecraft

Du'aine Davis

Observed in the wild

• In early January , researchers observed KongTuke actors deploying CrashFix, an evolution of the earlier ClickFix framework, targeting Windows users across enterprise and SMB environments via a malicious Chrome/Edge extension. Victims saw a spoofed “browser stopped abnormally” alert prompting a fake “scan”, initiating the infection chain. The threat particularly impacted users with unmanaged browsers or weak extension governance.
• CrashFix used a fraudulent Web Store extension (“NexShield”) to deliver a staged loader. The extension fetched payloads, abused finger.exe as a LOLBin for C2 communication, deployed PowerShell loaders, extracted a Python-based ModeloRAT variant, and employed strong anti‑VM, anti‑debug, AMSI bypassing, and DGA‑based domain rotation. The campaign is attributed to KongTuke, reusing and expanding ClickFix concepts (fake crash messaging, extension‑based persistence, staged script delivery).
• Organisations should block unmanaged browser extensions, enforce extension allow‑lists, and monitor for Defender alerts tied to AmsiScanBuffer tampering, suspicious finger.exe execution, Python processes in AppData, and outbound traffic to DGA‑style domains. Defender SmartScreen, Attack Surface Reduction (ASR) rules, and Controlled Folder Access should be enabled.

Dissecting CrashFix: KongTuke's New Toy | Huntress

Du'aine Davis

KongTuke Activity Evolves with Microsoft Teams Impersonation for ModeloRAT Delivery
Observed in the wild

• Following the KongTuke campaign, recent activity shows an updated ModeloRAT variant delivered via Microsoft Teams impersonating IT helpdesks, targeting enterprise users and expanding initial access beyond earlier Dropbox-based methods while retaining the established execution chain and tooling.
• Actors now leverage compromised or deceptive Microsoft Teams accounts for social engineering, persuading users to run obfuscated PowerShell. Payloads are written to %APPDATA%, unpacked, and executed via a portable Python environment (%APPDATA%\WPy64-*). Execution splits into reconnaissance and C2 components. Persistence includes ASEP Run keys and scheduled tasks. Samples reportedly bypass major EDR and lacked VirusTotal detections at time of analysis.
• Organisations are advised to restrict Microsoft Teams external communications and monitor for anomalous helpdesk-style outreach. Use Microsoft Defender to detect suspicious PowerShell execution, ZIP activity in %APPDATA%, and pythonw.exe running from user-writable paths. Alert on scheduled task creation and Run key modifications.

Hackers Hijack Microsoft Teams Accounts to Deliver ModeloRAT