KongTuke CrashFix and PS1Bot Malvertising Campaigns

In early 2025 and 2026, researchers identified significant escalations in browser-based social engineering campaigns, notably the KongTuke 'CrashFix' campaign and the PS1Bot modular malware framework. KongTuke utilizes a malicious Chrome extension named 'NexShield' that purposefully crashes the browser to trick users into executing PowerShell payloads via the Windows Run dialog. This chain culminates in the deployment of ModeloRAT, a Python-based trojan specifically targeting domain-joined corporate environments for persistence and reconnaissance.

Simultaneously, the PS1Bot framework has emerged as a stealthy threat delivered through malvertising and SEO poisoning. It employs in-memory execution and modular components to perform credential theft, screen capture, and keylogging, with a distinct focus on cryptocurrency wallet exfiltration. These campaigns share infrastructure and tradecraft overlaps with established actors like TA866 (Asylum Ambuscade) and various ransomware affiliates, indicating a highly networked cybercriminal ecosystem using legitimate utilities like finger.exe and Windows Management Instrumentation (WMI) to bypass traditional defenses.

These threats represent a maturing landscape of identity-based and browser-resident attacks. Organizations face increased risk from double-extortion actors, including the Akira and CMD Organization ransomware groups, who leverage these initial access vectors to deploy lockers and auction stolen data on public leak sites. The transition toward public bidding platforms for ransomed data marks a shift in the extortion model, potentially increasing financial pressure on victims.