Dissecting CrashFix: KongTuke's New Toy

KongTuke, a threat actor tracked since 2025, has launched a new campaign using a malicious browser extension called NexShield that impersonates uBlock Origin Lite. The extension causes browser crashes and displays fake security warnings to trick users into executing malicious commands. The campaign targets both home and corporate users, with domain-joined machines receiving a more sophisticated Python-based RAT named ModeloRAT. The attack chain involves multiple stages of obfuscation, anti-analysis techniques, and a Domain Generation Algorithm (DGA) for C2 communication. KongTuke employs extensive fingerprinting to avoid detection in analysis environments. The campaign demonstrates evolving social engineering tactics and a focus on infiltrating enterprise networks for potential lateral movement and data exfiltration.

• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• Hirudo: From Fake Updates to Patched Banking AppsMalware2026-10-14
• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• Inside a brand deal scam targeting YouTube creatorsCampaign2026-10-12