Malicious NexShield Chrome Extension Installation

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•1•0•11

Detects the installation of the NexShield malicious Chrome extension, which impersonates uBlock Origin Lite. The rule monitors for the creation or modification of 'manifest.json' files within Chrome extension directories and registry key activity related to the extension's installation, specifically flagging references to 'NexShield' or deceptive 'uBlock Origin Lite' naming conventions.