Malware
Malicious Ad‑Blocker Extension Disguised as CrashFix Leads to ModeloRAT Infection
A new campaign, CrashFix, distributes a fake ad‑blocker extension that intentionally crashes browsers before offering a bogus fix. The extension installs the ModeloRAT backdoor, targeting high‑value users. Defenders should block the extension, monitor for related process activity, and update endpoint detection rules.
What Happened
A malicious ad‑blocker extension, branded as CrashFix, has been distributed via popular extension stores. The extension deliberately crashes the browser, then presents a fake “fix” download. The download installs the ModeloRAT backdoor, which grants attackers remote control over the victim’s system.
Impact
Users of affected browsers (Chrome, Edge, Firefox) are at risk of a full system compromise. The RAT can exfiltrate credentials, pivot to other machines, and persist through system reboots. High‑value targets such as executives and privileged accounts are the primary focus.
What to Do
- Block the CrashFix extension ID in your browser policy or extension whitelisting solution.
- Deploy endpoint detection rules that flag the installation of ModeloRAT binaries and suspicious registry keys.
- Educate users to verify extension sources and to avoid installing extensions that request excessive permissions.
- Conduct a rapid scan of all endpoints for the ModeloRAT payload and remove any detected instances.
“The attackers are using a familiar ad‑blocker interface to lower user trust, then pivoting to a powerful RAT for long‑term persistence.”
Related articles
Chrome Extension 'Poper Blocker' Disguises Spyware, Exfiltrates User Data
A Chrome Web Store extension marketed as an ad‑blocker, 'Poper Blocker', has been identified as spyware that harvests and sends sensitive user data to remote servers. The app enjoys a 4.8‑star rating, 81,000 reviews, and a 'Featured' badge, misleading users into trusting it. Defenders should remove the extension, block its domains, and monitor for outbound data exfiltration.
Read briefing
ValleyRAT Backdoor Distributed via Signed Adware and DLL Sideloading
Threat actors are distributing the ValleyRAT backdoor disguised as a signed adware application called QN Wallpaper. The campaign uses DLL sideloading to execute malicious payloads while distracting users by installing legitimate software like Google Chrome or DingTalk. SecOps and system administrators should audit autorun entries, monitor unexpected DLL loading, and inspect endpoint exclusions.
Read briefing
RemControl Android Banking Malware Targets European and Canadian Users via Fake IPTV Ads
RemControl, a new Android malware‑as‑a‑service platform, has been delivering banking trojans through fake TVTap IPTV ad sites. The campaign, active since May, targets users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East. Defenders should block known malicious domains, enforce app‑store vetting, and monitor for phishing overlays on Android devices.
Read briefing
ClickFix Campaign in Ukraine Deploys Lunex Infostealer via Fake Cloudflare Pages
Over 100 Ukrainian websites were hijacked to serve a counterfeit Cloudflare verification page that prompted users to run a PowerShell command. The command installed Lunex Stealer, an infostealer that also installs the LunarAxe browser extension and NaiveMess component, giving attackers credential theft and remote control. Defenders should block malicious domains, monitor for Lunex signatures, and educate users against executing unknown scripts.
Read briefing