NexShield pitched itself as a privacy-focused ad blocker from the developer of well-established and highly trusted uBlock Origin. However, as security firm Huntress found, the extension initiates a variation of the ClickFix attack that has been dubbed "CrashFix"—a reference to the browser crash that precedes the fake security warning and malicious command prompt.
If you follow through, you'll see another fake window with instructions for executing commands in the Windows command prompt. This is the ClickFix attack: a form of social engineering that relies on fake error messages, CAPTCHAs, and command prompts to trick users into deploying malware onto their own devices.
Note that as of this writing, NexShield has been removed from the Chrome Web Store.
How to protect your system from malware
As general protection against similar attacks, only install browser extensions from trusted sources. This isn't a guarantee that you'll never encounter a malicious add-on in the Chrome Web Store or in other browsers, as hackers occasionally manage to sneak through the approval process and even get their extensions labeled as trusted or verified. Some extensions are only later injected with malicious code, essentially "waking up" their ability to attack.
Finally, never run codes or commands on your machine copied from websites or communication that you don't understand, and always verify instructions with an independent, trusted source. For this specific campaign, Huntress has other indicators of compromise you can look for on your system.
Hence then, the article about this ad blocker actually initiates clickfix attacks was published today ( ) and is available on Live Hacker ( Middle East ) The editorial team at PressBee has edited and verified it, and it may have been modified, fully republished, or quoted. You can read and follow the updates of this news or article from its original source.
Read More Details
Finally We wish PressBee provided you with enough information of ( This 'Ad Blocker' Actually Initiates ClickFix Attacks )
Also on site :