Malicious Browser Extension Crashes Browsers for ClickFix Attacks

A recently discovered malvertising campaign is utilizing a fake ad-blocking Chrome and Edge extension named NexShield to intentionally crash browsers, paving the way for ClickFix attacks. This campaign was spotted earlier this month and has been found to deliver a new Python-based remote access tool called ModeloRAT, specifically targeting corporate environments. The NexShield extension, which has since been removed from the Chrome Web Store, was masquerading as a privacy-first, high-performance, lightweight ad blocker, misleading users into installing it. The extension's developer was falsely claimed to be Raymond Hill, the original creator of the legitimate uBlock Origin ad blocker. Users of this extension are primarily at risk, with the potential for significant system compromise.

The technical explanation behind this attack involves the NexShield extension creating a denial-of-service (DoS) condition in the browser by establishing 'chrome.runtime' port connections in an infinite loop, thereby exhausting the browser's memory resources. This leads to a series of symptoms including frozen tabs, elevated CPU usage, increased RAM usage, and general browser unresponsiveness, ultimately forcing the browser to crash. Upon restarting the browser, the extension displays a deceptive pop-up warning of system security issues and prompts the user to scan their system for problems. This is a clever ruse, as executing the suggested commands leads to the deployment of malicious scripts and potentially the ModeloRAT tool. The command and control server's response varies depending on whether the host is domain-joined, with corporate environments being targeted with the ModeloRAT for system reconnaissance, PowerShell command execution, and other malicious activities. For non-domain hosts, the server's response indicates either a low priority or ongoing development. The exploitation chain involves social engineering tactics to trick users into installing the malicious extension, followed by the extension's self-propagated crash and the deceptive pop-up warnings. The attackers leverage the trust users have in ad-blocking extensions to gain initial access, showcasing the evolving nature of social engineering attacks.

The implications of this threat are significant, especially considering the potential for widespread compromise of corporate networks. The fact that the attackers are targeting enterprise environments suggests a strategic shift towards more lucrative targets. The ability of the ModeloRAT to perform system reconnaissance, execute commands, and modify the registry, among other capabilities, poses a considerable risk to the integrity and confidentiality of affected systems. It is crucial for users to exercise caution when installing browser extensions, ensuring they are from trusted sources. Moreover, organizations should implement robust security measures, including regular system cleanups, to prevent and mitigate such threats. The evolving nature of these attacks necessitates continuous monitoring and adaptation of defense strategies to stay ahead of emerging threats.

Attack Surface

Web Browser

Tactics

Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion

Techniques

• T1190 – Exploit Public-Facing Application
• T1204 – User Execution

SuperPRO's Threat Countermeasures Procedures

1. Ensure all browser extensions are from trusted sources and have good reviews.
2. Regularly review installed extensions and remove any unnecessary ones.
3. Implement robust security software that includes anti-malware and anti-virus capabilities.
4. Educate users on the dangers of installing unknown or unverified extensions.
5. Use a reputable ad blocker that is known for its security and privacy features.
6. Keep the operating system and all software up to date with the latest security patches.