Technology

Fake ad blocker breaks PCs in new malware extension scam

Published

2 months ago

February 16, 2026

Fake ad blocker breaks PCs in new malware extension scam

NEWYou can now listen to Fox News articles!

Fake browser extensions are nothing new, but this one takes things a step further by deliberately breaking your computer to scare you into infecting it.

Security researchers have uncovered a malicious Chrome and Edge extension called NexShield that pretends to be a fast, privacy-friendly ad blocker. Once installed, it crashes your browser on purpose and then tricks you into “fixing” the problem by running dangerous commands on your own PC.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

MALICIOUS GOOGLE CHROME EXTENSIONS HIJACK ACCOUNTS

A fake Chrome and Edge extension called NexShield crashes browsers to trick users into running malicious commands. (Sina Schuldt/picture alliance via Getty Images)

How the NexShield ad blocker scam works

NexShield was promoted as a lightweight ad blocker supposedly created by Raymond Hill, the real developer behind the popular uBlock Origin extension. That claim was false, but it helped the extension look legitimate enough to spread through online ads and search results before it was taken down from the Chrome Web Store.

Once installed, NexShield immediately starts abusing Chrome or Edge in the background. Researchers at Huntress found that it opens endless internal browser connections until your system runs out of memory (via Bleeping Computer). Tabs freeze, CPU usage spikes, RAM fills up and the browser eventually hangs or crashes completely.

After you restart the browser, NexShield displays a scary pop-up warning that claims your system has serious security problems. When you click to “scan” or “fix” the issue, you’re shown instructions telling you to open Command Prompt and paste a command that’s already been copied to your clipboard.

That single paste is the trap. The command launches a hidden PowerShell script that downloads and runs malware. To make detection harder, the attackers delay the payload execution for up to an hour after installation, creating distance between the extension and the damage it causes.

Why this fake browser extension attack is especially dangerous

This campaign is a new variation of the well-known ClickFix scam, which relies on convincing you to run commands yourself. Huntress calls this version CrashFix because instead of faking a system failure, it causes a real one.

In corporate environments, the attack delivers a Python-based remote access tool called ModeloRAT. This malware allows attackers to spy on systems, run commands, change system settings, add more malware and maintain long-term access. Researchers say the threat group behind it, tracked as KongTuke, appears to be shifting focus toward enterprise networks where the payoff is higher.

Home users weren’t the primary target in this campaign, but that doesn’t mean they’re safe. Even if the final payload was unfinished for consumer systems, uninstalling the extension alone is not enough. Some malicious components can remain behind. The biggest danger here isn’t a browser bug. It’s trust. The attack works because it looks like a helpful fix from a trusted tool, and it pressures you to act quickly while your system feels broken.

“Microsoft Defender provides built in protections to help identify and stop malicious or unwanted browser extensions and the harmful behaviors associated with them,” Tanmay Ganacharya, VP of Microsoft Threat Protection, told CyberGuy. “Our security technologies are designed to detect and mitigate tactics like the ones described in this campaign, and they are continuously updated to help keep customers safe. We encourage consumers and organizations to follow our security best practices for reducing exposure to social engineering based threats. Guidance on strengthening your security posture against techniques like this can be found in our blog, ⁠Think Before You Click(Fix): Analyzing the ClickFix Social Engineering Technique, on the Microsoft Security blog.”

We also reached out to Google for comment.

7 steps you can take to stay safe from malicious browser extensions

A few smart habits and the right tools can dramatically reduce your risk, even when malicious extensions slip past official app stores.

1) Only install extensions from trusted publishers

Before installing any browser extension, check the publisher name, official website and update history. Reputable tools clearly identify their developer and have years of user reviews. Be cautious of “new” extensions that claim to come from well-known creators, especially if the name or branding looks slightly off.

2) Never run unknown commands

No legitimate browser extension will ever ask you to open Command Prompt or paste a command to fix an issue. That’s a massive red flag. If something breaks your browser and then tells you to run system commands, close it and seek help from a trusted source.

3) Use a strong antivirus

Strong antivirus software can detect malicious scripts, suspicious PowerShell activity and remote access tools like ModeloRAT. This is especially important because these attacks rely on delayed execution that basic defenses might miss.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

MALICIOUS MAC EXTENSIONS STEAL CRYPTO WALLETS AND PASSWORDS

After freezing your browser, the rogue extension urges users to paste a PowerShell command that installs malware. (Annette Riedl/picture alliance via Getty Images)

4) Use a password manager to limit fallout

If malware gains access to your system, stored browser passwords are often the first target. A password manager keeps credentials encrypted and separate from your browser, reducing the risk of account takeover even if something slips through.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

5) Keep Windows, Chrome and Edge fully updated

Security updates don’t just patch bugs. They also improve protection against malicious extensions, script abuse and unauthorized system changes. Turn on automatic updates so you’re not relying on memory to stay protected.

6) Consider an identity theft protection service

If malware ever runs on your system, assume personal data could be at risk. Identity protection services can monitor for misuse of your information, alert you early and help with recovery if fraud occurs.

Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

7) Reduce your online footprint with a data removal service

Many attacks become more effective when criminals already have your personal details. Data removal services help pull your information from broker sites, making it harder for attackers to craft convincing follow-up scams or targeted phishing.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

FAKE ERROR POPUPS ARE SPREADING MALWARE FAST

Security researchers say the NexShield ad blocker scam deliberately overloads memory to force a system crash. (Photo by Sebastian Gollnow/picture alliance via Getty Images)

Kurt’s key takeaway

Cybercriminals are getting better at blending technical tricks with psychological pressure. Instead of relying on exploits alone, they break things on purpose and wait for you to panic. If a browser extension crashes your system and then tells you to “fix” it by running commands, stop immediately. The safest response is not to fix the problem fast, but to question why you’re being asked to fix it at all.

How many browser extensions are installed on your computer right now? Let us know by writing to us at Cyberguy.com.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:cybercrime Featured Privacy Security

Click to comment

Technology

Buy two Nintendo Switch games, get $30 off at Target

Published

3 hours ago

April 5, 2026

Press Room

Buy two Nintendo Switch games, get off at Target

Target is offering a great deal to some Target Circle members that knocks $30 off the cost of two Nintendo Switch and Switch 2 games. The sale is happening for the rest of the day, expiring at 2:59AM ET on April 5th. If you sign in with the free-to-join membership, you might be able to add two eligible games to your cart, then watch the prices fall at checkout.

There are 224 eligible games (some physical, some digital), and many of Nintendo’s biggest hits from the past year and beyond are here, including Switch 2-exclusive games like Donkey Kong Bananza, Kirby Air Riders, Mario Kart World, Mario Tennis Fever, and more (I didn’t see Pokémon Pokopia in the list, though).

This deal is worth hopping on whether you intend to gift these games, or just get them for yourself. Discounts on Nintendo-published games are rare, and it’s quite a nice perk that Target Circle members have in getting to choose the games they want to save on.

While each of the games that I mentioned ship on cartridges that don’t require a bunch of your console’s internal storage (just enough for save data), there are some Switch 2 games that ship on Game Key Cards. Those cartridges, once inserted into the console, simply grant you the ability to download a copy from the Nintendo eShop onto your console. Game sizes varies, but you may want to pick up a microSD Express card to add more storage on top of the Switch 2’s 256GB built-in SSD. This 256GB Samsung model is $59 at Amazon.

Technology

How to opt out of AI data collection in popular apps

Published

4 hours ago

April 5, 2026

Press Room

How to opt out of AI data collection in popular apps

NEWYou can now listen to Fox News articles!

Every time you ask ChatGPT a question, say “Hey Siri” or let Google finish your sentence, something else may happen in the background. In many cases, you are helping train the AI that responds to you.

Most people do not realize this. However, many AI platforms use conversations to improve their systems. As a result, your questions, your voice and your habits can be stored and reused by some of the world’s largest tech companies.

That said, you are not stuck with these settings. You can turn off much of this data collection if you know where to look. Even better, it only takes about 15 minutes across the major platforms. Here is exactly how.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com — trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

5 SIMPLE TECH TIPS TO TAKE BACK CONTROL OF YOUR SOCIAL MEDIA

What AI apps are quietly collecting about you

AI assistants are designed to feel like a private conversation. But, depending on the platform, what’s collected often goes well beyond what you typed or said:

Full conversation transcripts
Voice recordings and audio clips
Location data and device identifiers
Browsing habits and search history
Names, routines and personal details you mention in passing
App usage patterns across your devices.

Almost none of this is turned off by default. You have to go find the switch yourself.

Think about what you’ve actually shared lately

Here’s a quick thought experiment. In the last month, have you asked an AI assistant about:

A health symptom you were worried about?
A financial decision you were weighing?
A family situation you needed advice on?
Your child’s schedule, school or activities?

Each detail seems harmless on its own. But, together, they create a surprisingly detailed picture of your life, one that could be stored indefinitely, reviewed by human contractors or exposed in a data breach.

In 2023, Samsung engineers accidentally leaked sensitive internal code by pasting it into ChatGPT. Most people don’t have an IT department watching out for them. But everyone can take a few minutes to adjust their settings.

How to opt out platform by platform

This doesn’t mean you should stop using AI tools. They can be incredibly useful. But it’s worth understanding what’s being collected and what you can turn off right now.

1) ChatGPT (OpenAI)

By default, your conversations may be used to help improve AI models, but you can turn this off at any time.

To turn this off:

Open ChatGPT
Tap or click your profile icon
Select Settings
Go to Data Controls
Toggle off “Improve the model for everyone”

You can also go to Settings > Data Controls > Export data to download everything OpenAI has stored, or select Delete all chats to wipe your history. Note that even with training off, OpenAI retains conversations for up to 30 days for safety monitoring.

Turning off “Improve the model for everyone” stops your ChatGPT conversations from being used for training. (Kurt “CyberGuy” Knutsson)

2) Google (Gemini & AI features)

Google’s AI tools, including Gemini and Search’s AI Overviews, are tied to your Google account activity.

To manage this:

Go to myactivity.google.com
Select Web & App Activity and turn it off, or set auto-delete to three months
Separately, visit gemini.google.com > Settings > Gemini Apps Activity and toggle it off

Keep in mind that disabling activity tracking may affect personalization across Gmail, Maps and other Google services.

DATA BROKERS ACCUSED OF HIDING OPT-OUT PAGES FROM GOOGLE

Google’s Gemini activity settings show how your AI interactions may still be stored unless you delete them. (Kurt “CyberGuy” Knutsson)

3) Microsoft Copilot

Copilot is built into Windows, Microsoft 365 and Edge, so it can access a wide range of your documents and activity.

To adjust your settings:

Go to account.microsoft.com/privacy and sign in
Click Privacy in the left-hand menu
Scroll to App and service activity and review your recent activity
Click Clear all activities or remove individual items
Scroll down to App and service performance data, and clear that data if available
Scroll further and select Copilot, then tap Manage data from Microsoft Copilot to review or delete your data

In Windows 11: Settings > Privacy & Security > Diagnostics & Feedback and turn off Optional diagnostic data

Microsoft does not offer one single switch that turns off all Copilot data collection, so you need to review settings in multiple places. Enterprise users should check with an IT administrator since organizational settings may also apply.

Microsoft’s privacy dashboard lets you review and clear app and service activity tied to your account. (Kurt “CyberGuy” Knutsson)

4) Amazon Alexa

Alexa stores voice recordings by default, and, in some cases, Amazon may have human reviewers listen to those recordings as part of its quality review process.

To turn off voice recording use:

Open the Alexa app
Tap More (upper left, three lines)
Tap Alexa Privacy
Scroll down and select Manage Your Alexa Data
Tap Help Improve Alexa and turn off Use Voice Recordings
Confirm your decision by tapping Turn off

To stop Alexa from keeping your recordings:

Open the Alexa app
Tap More (upper left, three lines)
Tap Alexa Privacy
Scroll down and select Manage Your Alexa Data
Tap Voice Recordings and Transcripts
Select Don’t retain

In the Alexa app, turning off voice recording use prevents Amazon from using your recordings to improve services. (Kurt “CyberGuy” Knutsson)

5) Apple Siri

Apple is generally more privacy-focused than other platforms, but Siri still collects data to improve its performance.

To limit Siri data collection:

Go to Settings
Tap Privacy & Security
Tap Analytics & Improvements
Turn off Share iPhone & Apple Watch Analytics
Scroll down and turn off Improve Siri & Dictation

To delete your existing Siri history:

Go to Settings, Tap Siri or Apple Intelligence & Siri Tap Siri & Dictation History Tap Delete Siri & Dictation History

Disabling analytics on iPhone limits how Apple collects data to improve Siri and other features. (Kurt “CyberGuy” Knutsson)

Why AI privacy settings are only part of the solution

Adjusting these settings is an important step. But it only controls what these apps collect directly going forward. It doesn’t address the hundreds of websites that may already be publishing your personal information online, right now, without your knowledge.

Data brokers are still collecting your information

Data brokers do not need your AI chat history. Instead, they pull information from public records, marketing lists and people search databases. They also refresh these profiles constantly, which keeps your data active and easy to find.

As a result, your name, address, phone number and family members may already appear on dozens of sites you have never heard of. Unlike AI apps, these sites do not offer a single settings menu to turn this off.

While you can remove your data manually, the process takes hours and often requires repeated requests when your information gets reposted. In many cases, you need to revisit these sites regularly to keep your information from reappearing.

The goal is simple: make it much harder for strangers, scammers and cybercriminals to find your personal information online.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Kurt’s Key Takeaways

Spending just 15 minutes adjusting your AI privacy settings is one of the most effective steps you can take to protect your digital privacy right now. Most major platforms, including OpenAI, Google, Microsoft, Amazon and Apple, collect data by default. However, you can opt out, even though companies often bury these settings deep in menus.

As a result, many people never find them. At the same time, AI assistants feel private and conversational, so you may share more personal information than you realize. Even if you turn off data collection going forward, companies do not erase what they have already stored. In addition, these settings only control what happens inside each platform. Data brokers still build separate profiles about you using information pulled from across the internet.

Because of this, privacy is not a one-time fix. Instead, you need to check your settings regularly and stay aware of what you share. The good news is you do not have to stop using AI tools. Instead, take a few minutes this week to review your settings and make sure the rest of your digital footprint is not working against you.

How much personal data are you willing to let big tech companies collect from your everyday AI use? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Technology

A folk musician became a target for AI fakes and a copyright troll

Published

15 hours ago

April 4, 2026

Press Room

A folk musician became a target for AI fakes and a copyright troll

In January, folk artist Murphy Campbell discovered several songs on her Spotify profile that did not belong there. They were songs that she had recorded, but she’d never uploaded them to Spotify, and something was off about the vocals.

She quickly surmised that someone had pulled performances of the songs she posted to YouTube, created AI covers, and uploaded them to streaming platforms under her name. I ran one of the songs, “Four Marys”, through two different AI detectors, and it seemed to support her suspicions with both saying it was probably AI-generated.

Campbell was shocked, “I was kind of under the impression that we had a little bit more checks in place before someone could just do that. But, you know, a lesson learned there,” she told The Verge. It took some time before Campbell managed to get the fake songs removed, “I became a pest,” she said. And even then, it wasn’t a complete victory. While the offending tracks don’t appear to be available on YouTube Music or Apple Music anymore, at least one can still be found on Spotify, just under a different artist profile, but with the same name. There are now multiple Murphy Campbells — “Obviously, I was thrilled by that,” the real Murphy Campbell said.

Spotify is testing a new system that would allow artists to manually approve songs before they appear on their profile, but Campbell is skeptical after being burned. “I feel like, every time, an entity that’s that large makes a promise like that to musicians. It seems to just not be what they made it out to be, but I’ll be curious to try it out in the future,” she said.

This was just the beginning of Campbell’s nightmare, however.

On the day that a Rolling Stone article was published, discussing Campbell’s brush with AI imitators, a series of videos were uploaded to YouTube through distributor Vydia. Those videos have not been posted publicly, and it’s unclear if anyone other than the uploader, who goes by Murphy Rider, has seen them. YouTube declined to comment for this story.

Those were used to claim ownership of the material in several of Murphy Campbell’s videos. Campbell received a notice from YouTube reading: “You are now sharing revenues with the copyright owners of the music detected in your video, Darling Corey.” The most confusing part, the songs at the center of these claims are all in the public domain, including the classic “In the Pines,” which dates back to at least the 1870s and has been covered by everyone from Lead Belly to Nirvana (as “Where Did You Sleep Last Night”).

Vydia has since released those claims, and spokesperson Roy LaManna says the person who uploaded the videos has been banned from their platform. Of the over 6,000,000 claims filed by Vydia through YouTube’s Content ID system, 0.02 percent were found to be invalid, which LaManna says is, “by industry standards is like amazing.” Continuing, “we pride ourselves on doing this the right way.”

LaManna also says that Vydia has no connection to Timeless IR or the AI covers that were uploaded to streaming platforms under Campbell’s name. While the timing is certainly suspicious, LaManna says the two incidents are separate.

Vydia has received a lot of blowback including, LaManna says, “literal death threats” which have led to the offices being evacuated. Campbell isn’t about to let Vydia off the hook, but notes that it’s not solely to blame. The worlds of generative AI, music distribution, and copyright are complex with multiple points of failure and opportunities for abuse. “I think it goes way deeper than we think it does,” Campbell says.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.