Researchers uncovered a CrashFix campaign where a fake Chrome ad blocker crashes browsers to trick users into installing the ModeloRAT malware.

The Tidyverse Blog offers insights, tutorials, and updates on the Tidyverse, a collection of R packages for data science and statistical computing. Covering topics such as data manipulation, visualization, and analysis, the blog provides resources for R developers looking to leverage the power of the Tidyverse for their data projects. Developers can learn how to use Tidyverse packages effectively to clean, transform, and analyze data in R.

The Hacker News

A malicious Chrome extension called "NexShield – Advanced Web Guardian" deliberately crashes browsers using a denial-of-service attack, then displays fake security warnings to trick users into executing commands that install ModeloRAT malware. The extension, downloaded over 5,000 times before removal, clones the legitimate uBlock Origin Lite and uses ClickFix-style social engineering. The attack chain employs multiple obfuscation layers, anti-analysis techniques, and targets domain-joined machines for corporate network access. ModeloRAT is a Python-based remote access trojan with adaptive beaconing that communicates via RC4 encryption and can execute various payloads.

CrashFix Chrome Extension Delivers ModeloRAT Using ClickFix-Style Browser Crash Lures