Fake ad blocker crashes your browser on purpose: how to spot the CrashFix trap

Picture this. You installed what looked like a perfectly normal ad blocker. An hour later, your browser freezes, eats your RAM, and dies. You restart it and a tidy little security warning pops up: "Your browser stopped abnormally — run this command to fix it." You're annoyed, you just want your tabs back, so you follow the instructions. That's the whole trick. The crash was real, and it was the bait.

That's the CrashFix attack, and it's one of the more devious extension scams I've looked at this year. It doesn't steal your passwords on day one. It deliberately breaks your browser so you'll trust the "fix" — and the fix is malware.

What actually happened

In January 2026, threat-hunting firm Huntress spotted a Chrome extension called "NexShield – Advanced Web Guardian" behaving very strangely. It was a near-identical clone of uBlock Origin Lite, the well-known open-source content blocker — same look, same description, right down to the version string. To be clear: uBlock Origin itself is legitimate. NexShield just wore its face.

According to BleepingComputer's reporting, NexShield racked up at least 5,000 installs before Google pulled it from the Chrome Web Store. The extension is tracked back to a threat group known as KongTuke, which Huntress has followed since early 2025. Microsoft later weighed in too — its security team called the technique "a notable escalation in ClickFix tradecraft."

Here's the part that makes it clever. Most "ClickFix" scams show you a fake error message while your browser keeps running fine. NexShield went further: it actually crashed the browser for real. SecurityWeek, covering the same Huntress research, described how the extension exhausts your system's memory until everything seizes up.

How a browser extension crashes your browser

The mechanism is almost elegant in how mundane it is. Extensions talk to their own background scripts using a messaging system called chrome.runtime. When a content script wants to send data back and forth, it opens a "port" — basically a persistent communication channel — using chrome.runtime.connect(). Totally normal. Every other extension does it.

NexShield abused that. Roughly an hour after install, it started opening these ports in an infinite loop, over and over, never closing them. Each open port holds a little memory, so open enough of them fast enough and the browser balloons until it runs out of memory and crashes.

According to the Huntress analysis, it took about 60 minutes post-install for the browser to fall over — long enough that you wouldn't connect the crash to the extension you added earlier.

No exotic exploit. No zero-day. Just a legitimate API used the wrong way on purpose. That's what I find unsettling about it — the "weapon" is the same plumbing that every well-behaved extension relies on. There's no permission prompt that says "this extension may exhaust your memory," because no honest extension would ever want to.

The delay is doing real work, too. An hour is long enough that by the time things break, you've opened a dozen other tabs, switched apps, maybe installed something else. The one thing you're least likely to blame is the ad blocker you added and forgot about. The attack buys its own deniability.

The fix that isn't a fix

After the crash and a restart, victims saw a fake security prompt claiming the browser "stopped abnormally." It then copied a malicious PowerShell command to the clipboard and walked the user through pasting and running it — the classic ClickFix pattern of getting you to execute the payload so the attacker doesn't have to bypass any download protection.

That command pulled down ModeloRAT, a Python-based remote-access trojan. Per the Huntress and BleepingComputer write-ups, ModeloRAT uses RC4-encrypted communication with its command server, hides in the Windows registry under innocent-looking names like "Spotify47" or "Adobe2841," and is built for lateral movement across a network.

One detail tells you exactly who this was built for: ModeloRAT only fully activated on domain-joined Windows machines — corporate computers. Home users who triggered the same chain reportedly got a harmless stub instead. KongTuke wasn't fishing for random consumers. They were hunting company laptops, quietly, while avoiding the noise that infecting everyone would create.

Why this matters for you

The uncomfortable takeaway: the permission screen wouldn't have saved you here. NexShield didn't need scary permissions to pull this off. Opening chrome.runtime ports is something extensions do by default — there's no "this extension can crash your browser" warning, because crashing your browser isn't supposed to be a feature.

And the attack flips your own instincts against you. A frozen, crashing browser makes you anxious and impatient. In that state, a calm-looking "here's how to fix it" message is exactly what you want to see. The crash manufactures the panic; the lure sells the cure. That emotional setup is the real payload — the technical crash is just there to make it convincing.

The bigger pattern: ClickFix is getting physical

CrashFix matters beyond this one extension because it shows where ClickFix is heading. The first wave of these attacks was pure theater — a fake CAPTCHA, a fake "verify you're human" box, a fake update screen — and the only thing being faked was the problem. The cure was always malware, but the disease was imaginary.

NexShield made the disease real. By weaponizing a normal browser API to cause an actual, verifiable crash, the attacker removes the one thing that lets a skeptical user shrug off a ClickFix lure: the nagging sense that nothing was actually wrong. When your browser genuinely just died, the "recovery" instructions feel earned.

This is the same playbook I've written about with hijacked extensions that turn malicious after an ownership change and with turnkey phishing kits sold to get past Chrome Web Store review. The common thread is that the Chrome Web Store badge and the install-time permission list are weaker signals than most people assume. Expect more copycats to borrow the "break something real, then sell the fix" structure — it works too well not to.

How to protect yourself

You can't out-click a scam built around your impatience, but you can build a few habits that defang it.

Never paste a command you didn't write into a terminal or Run box. This is the single rule that breaks the entire ClickFix family. No legitimate browser, OS, or extension will ever fix a crash by having you copy-paste a PowerShell or terminal command from a popup. If a "fix" involves the clipboard and a command line, it's an attack. Full stop. Close the window and walk away.

Verify the publisher, not just the name and icon. NexShield copied uBlock Origin Lite down to the pixel. Before installing anything, check the developer name on the store listing, the install count, and whether it links to a real homepage or repository.

A content blocker with 5,000 installs claiming to be uBlock Origin is a red flag — the real one has millions. When in doubt, install from a link on the project's official site rather than searching the store and picking the top result.

Treat a sudden browser crash right after a new install as a clue, not a coincidence. If your browser starts freezing or eating memory shortly after you added an extension, that timing is meaningful. Open your extension manager — chrome://extensions on Chrome, about:addons on Firefox — and disable the most recent additions one at a time. Don't follow any "recovery" prompt that appears after the crash.

Audit and trim what you've already got. Every extension is standing attack surface, and a clone you forgot about is the perfect hiding spot — the same reason abandoned, unmaintained extensions are worth clearing out. Go through your list and remove anything you haven't used in the last few weeks. You can get a cleaner cross-browser overview of what's installed at catalog.extenshi.io than the browser's own manager gives you.

For company machines: enforce an extension allowlist. CrashFix targeted domain-joined devices on purpose. Chrome for Enterprise and Edge for Business both let IT teams restrict installs to an approved set of extensions. An allowlist would have stopped NexShield from ever landing — it's the highest-confidence control against impersonation attacks like this, and it cuts general extension sprawl as a bonus.

How Extenshi helps

Extenshi catalogs extensions across Chrome, Firefox, and Edge, and surfaces the signals that matter for catching impersonators: the real publisher, install counts, declared permissions, recent update activity, and how an extension stacks up against the legitimate project it might be mimicking. When a 5,000-install "uBlock Origin Lite" sits next to the genuine article with millions of users, the mismatch is obvious at a glance.

I'll be straight about the limits: a scan won't catch a malicious PowerShell command after your browser has already crashed — that's on the "never paste unknown commands" rule. What a scan does is help you weed out the suspicious clones and forgotten extensions before one of them gets the chance to set the trap. Fewer sketchy extensions, fewer openings.

Take five minutes and look at what's actually running in your browser.

Scan your extensions →

---

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].