Connect with us

Technology

Fake ad blocker breaks PCs in new malware extension scam

Published

on

Fake ad blocker breaks PCs in new malware extension scam

NEWYou can now listen to Fox News articles!

Fake browser extensions are nothing new, but this one takes things a step further by deliberately breaking your computer to scare you into infecting it.

Security researchers have uncovered a malicious Chrome and Edge extension called NexShield that pretends to be a fast, privacy-friendly ad blocker. Once installed, it crashes your browser on purpose and then tricks you into “fixing” the problem by running dangerous commands on your own PC.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

MALICIOUS GOOGLE CHROME EXTENSIONS HIJACK ACCOUNTS

Advertisement

A fake Chrome and Edge extension called NexShield crashes browsers to trick users into running malicious commands. (Sina Schuldt/picture alliance via Getty Images)

How the NexShield ad blocker scam works

NexShield was promoted as a lightweight ad blocker supposedly created by Raymond Hill, the real developer behind the popular uBlock Origin extension. That claim was false, but it helped the extension look legitimate enough to spread through online ads and search results before it was taken down from the Chrome Web Store.

Once installed, NexShield immediately starts abusing Chrome or Edge in the background. Researchers at Huntress found that it opens endless internal browser connections until your system runs out of memory (via Bleeping Computer). Tabs freeze, CPU usage spikes, RAM fills up and the browser eventually hangs or crashes completely.

After you restart the browser, NexShield displays a scary pop-up warning that claims your system has serious security problems. When you click to “scan” or “fix” the issue, you’re shown instructions telling you to open Command Prompt and paste a command that’s already been copied to your clipboard.

That single paste is the trap. The command launches a hidden PowerShell script that downloads and runs malware. To make detection harder, the attackers delay the payload execution for up to an hour after installation, creating distance between the extension and the damage it causes.

Advertisement

Why this fake browser extension attack is especially dangerous

This campaign is a new variation of the well-known ClickFix scam, which relies on convincing you to run commands yourself. Huntress calls this version CrashFix because instead of faking a system failure, it causes a real one.

In corporate environments, the attack delivers a Python-based remote access tool called ModeloRAT. This malware allows attackers to spy on systems, run commands, change system settings, add more malware and maintain long-term access. Researchers say the threat group behind it, tracked as KongTuke, appears to be shifting focus toward enterprise networks where the payoff is higher.

Home users weren’t the primary target in this campaign, but that doesn’t mean they’re safe. Even if the final payload was unfinished for consumer systems, uninstalling the extension alone is not enough. Some malicious components can remain behind. The biggest danger here isn’t a browser bug. It’s trust. The attack works because it looks like a helpful fix from a trusted tool, and it pressures you to act quickly while your system feels broken.

“Microsoft Defender provides built in protections to help identify and stop malicious or unwanted browser extensions and the harmful behaviors associated with them,” Tanmay Ganacharya, VP of Microsoft Threat Protection, told CyberGuy. “Our security technologies are designed to detect and mitigate tactics like the ones described in this campaign, and they are continuously updated to help keep customers safe. We encourage consumers and organizations to follow our security best practices for reducing exposure to social engineering based threats. Guidance on strengthening your security posture against techniques like this can be found in our blog, ⁠Think Before You Click(Fix): Analyzing the ClickFix Social Engineering Technique, on the Microsoft Security blog.”

We also reached out to Google for comment.

Advertisement

7 steps you can take to stay safe from malicious browser extensions

A few smart habits and the right tools can dramatically reduce your risk, even when malicious extensions slip past official app stores.

1) Only install extensions from trusted publishers

Before installing any browser extension, check the publisher name, official website and update history. Reputable tools clearly identify their developer and have years of user reviews. Be cautious of “new” extensions that claim to come from well-known creators, especially if the name or branding looks slightly off.

2) Never run unknown commands

No legitimate browser extension will ever ask you to open Command Prompt or paste a command to fix an issue. That’s a massive red flag. If something breaks your browser and then tells you to run system commands, close it and seek help from a trusted source.

3) Use a strong antivirus

Strong antivirus software can detect malicious scripts, suspicious PowerShell activity and remote access tools like ModeloRAT. This is especially important because these attacks rely on delayed execution that basic defenses might miss.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Advertisement

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

MALICIOUS MAC EXTENSIONS STEAL CRYPTO WALLETS AND PASSWORDS

After freezing your browser, the rogue extension urges users to paste a PowerShell command that installs malware. (Annette Riedl/picture alliance via Getty Images)

4) Use a password manager to limit fallout

If malware gains access to your system, stored browser passwords are often the first target. A password manager keeps credentials encrypted and separate from your browser, reducing the risk of account takeover even if something slips through.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Advertisement

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

5) Keep Windows, Chrome and Edge fully updated

Security updates don’t just patch bugs. They also improve protection against malicious extensions, script abuse and unauthorized system changes. Turn on automatic updates so you’re not relying on memory to stay protected.

6) Consider an identity theft protection service

If malware ever runs on your system, assume personal data could be at risk. Identity protection services can monitor for misuse of your information, alert you early and help with recovery if fraud occurs.

Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

Advertisement

7) Reduce your online footprint with a data removal service

Many attacks become more effective when criminals already have your personal details. Data removal services help pull your information from broker sites, making it harder for attackers to craft convincing follow-up scams or targeted phishing.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

FAKE ERROR POPUPS ARE SPREADING MALWARE FAST

Advertisement

Security researchers say the NexShield ad blocker scam deliberately overloads memory to force a system crash. (Photo by Sebastian Gollnow/picture alliance via Getty Images)

Kurt’s key takeaway

Cybercriminals are getting better at blending technical tricks with psychological pressure. Instead of relying on exploits alone, they break things on purpose and wait for you to panic. If a browser extension crashes your system and then tells you to “fix” it by running commands, stop immediately. The safest response is not to fix the problem fast, but to question why you’re being asked to fix it at all.

How many browser extensions are installed on your computer right now? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Advertisement

Copyright 2026 CyberGuy.com. All rights reserved.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Trump administration is allegedly collecting $10 billion on the TikTok deal

Published

on

Trump administration is allegedly collecting  billion on the TikTok deal

In September, Donald Trump claimed that “the United States is getting a tremendous fee” for brokering the TikTok deal. Now sources tell the Wall Street Journal and the New York Times that fee is expected to be in the range of $10 billion. The money is supposedly being paid by new investors, including Oracle and Silver Lake. Reports are that $2.5 billion was already paid to the Treasury when the deal closed on January 22nd. The rest will be paid out in installments.

This is the latest example of the Trump administration inserting itself into private business in unprecedented ways, including taking on a 10-percent stake in Intel last August, a “golden share” in US Steel, and a 20-percent cut in chip sales from Nvidia to China. In this instance, the deal also involves one of Trump’s biggest supporters and fundraisers, Larry Ellison, co-founder and CTO of Oracle.

If the reporting is accurate, the fee would represent over 70 percent of the deal’s value, which saw a group of investors take a majority stake in TikTok for $14 billion.

Continue Reading

Technology

Iran-linked hackers target US medical tech company

Published

on

Iran-linked hackers target US medical tech company

NEWYou can now listen to Fox News articles!

When most people hear about cyberattacks tied to geopolitical conflict, it can seem far away. It sounds like something that happens to governments or giant corporations. Yet the latest cyber incident involving a U.S. medical technology company shows how fragile digital systems can be. Even more important, it raises a question you should all ask yourself: Are you protected against trouble, too?

A hacker group linked to Iran has claimed responsibility for a cyberattack on Stryker, a Michigan-based company that produces medical equipment and healthcare technology used worldwide. Stryker employs about 56,000 people and operates in more than 60 countries, making it one of the largest medical technology companies in the world.

Stryker disclosed the incident in a filing with the U.S. Securities and Exchange Commission, saying the disruption affected parts of its Microsoft environment and that investigators are working to determine the full scope.

The incident appears to be one of the most significant cyber incidents linked to the current conflict so far.

Advertisement

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Laboratory assistants from the company BioNTech wear Stryker medical gear in a clean room at a production site in Marburg, Germany, in March 2021. (Boris Roessler/picture alliance via Getty Images)

What happened in the Stryker cyberattack

According to reports, the attack disrupted parts of Stryker’s global network environment. Reports indicate the outages began shortly after midnight on Wednesday on the East Coast. Employees suddenly discovered that their work-issued phones stopped functioning. Communication across teams stalled as devices became unusable.

ANDROID FIXES 129 SECURITY FLAWS IN MAJOR PHONE UPDATE

The hacker group Handala claimed responsibility on social media platforms, including Telegram and X. However, the claim has not been independently verified. Some employees also reported seeing the hacker group’s logo appear on company login pages during the disruption. In posts online, the group said the attack was retaliation for a bombing at a school in Minab, Iran, though those claims have not been independently verified.

Advertisement

Security experts believe the attackers may have gained access to the company’s Microsoft Intune management console. This platform allows companies to manage corporate devices such as smartphones and laptops remotely. Once inside that system, attackers appear to have triggered a powerful administrative feature. Reports suggest many company-connected phones and laptops were wiped back to factory settings.

Signage at the Stryker Corp. headquarters in Portage, Michigan, on Thursday, March 12, 2026. A cyberattack on Stryker Corp. has kept the medical technology company’s ordering and shipping systems offline as the firm continues to struggle to address a crippling hack claimed by a group linked to Iran.   (Kristen Norman/Bloomberg via Getty Images)

How hackers may have used legitimate tools against the company

The attack did not rely on traditional ransomware or malware. Instead, the hackers appear to have used a legitimate system feature in a destructive way. Remote wipe tools exist for good reasons. Companies use them when a device is lost, stolen or retired. However, if attackers gain control of the management console, those same tools can become weapons. Some cybersecurity researchers believe attackers may have accessed the company’s Microsoft Intune device management system, though the exact method of the attack has not been publicly confirmed.

Once the attackers accessed the device management system, they likely triggered remote wipe commands across multiple employee devices. The result looked like a mass reset event that effectively shut down normal operations. Stryker later confirmed it experienced a cybersecurity incident affecting its Microsoft environment. The company said it saw no evidence of ransomware or malware and believes the incident is contained. Stryker said it has activated business continuity measures so it can continue supporting customers and partners while systems are restored.

Iran’s long history of destructive cyberattacks

This type of attack fits into a broader pattern. Iran-linked groups have previously launched some of the most damaging “wiper” cyberattacks on record. These attacks aim to destroy data rather than steal it.

Advertisement

Two notable examples include:

Since the start of the current conflict, cybersecurity companies such as Google and Proofpoint have mostly observed Iranian groups conducting espionage operations. However, the Stryker disruption may signal a shift toward more aggressive actions targeting corporate infrastructure. We contacted both Stryker and Microsoft for comment but did not hear back before our deadline.

Why this matters beyond one company

Large cyber incidents rarely stay isolated. When attackers demonstrate a new method, other groups often study and reuse it. That means techniques used against a corporation today can show up in smaller attacks tomorrow. Small businesses, hospitals and even individuals sometimes become targets when criminals adapt the same tactics. In other words, this story about a medical technology company also carries a warning for everyday digital life. 

The logo of Stryker medical technology is seen on their plant in the IDA (Industrial Development Agency) estate, in Carrigtwohill, County Cork, Ireland on March 28, 2025. (Reuters/Clodagh Kilcoyne)

How to protect yourself from cyberattacks and device wipe threats

Cyberattacks against corporations reveal weaknesses that can affect anyone who uses connected devices. A few proactive steps can reduce your risk.

Advertisement

1) Use strong and unique passwords

Never reuse passwords across accounts. If attackers obtain one password, they often test it across many services. Consider using a password manager to generate and securely store complex passwords, so you do not need to remember them. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

2) Enable two-factor authentication

Adding a second verification step, such as two-factor authentication (2FA), can stop attackers even if they obtain your password.

3) Consider a data removal service

Data broker sites collect and sell personal details that criminals may exploit. Removing that information can reduce your exposure. Check out my top picks for data removal services, and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

4) Install strong antivirus software

Reliable antivirus protection helps detect suspicious activity, phishing attempts and malware before it can spread. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

5) Back up important files regularly

If a device is wiped or compromised, backups allow you to restore critical data quickly.

Advertisement

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

Kurt’s key takeaways

Cyberattacks once focused mainly on stealing information. Today, many attackers try to disrupt systems, erase data or create chaos. The reported incident involving Stryker shows how hackers can turn everyday administrative tools into powerful weapons. If someone gains access to the right controls, they may not need traditional malware at all. For many people, cyber conflict between countries can seem far away. Yet the same technology involved in those attacks powers the devices and services we rely on every day. Your phone, laptop and cloud accounts all connect to systems that depend on trust and access permissions. That is why digital safety now requires layers of protection. Strong passwords help. Secure devices help. Staying aware of threats helps, too. Preparation can make the difference between a quick recovery and a major disruption. If something unexpected happens, the people who bounce back fastest are usually those who took a few steps to protect themselves in advance.

And that leads to an important question: If your phone, laptop or cloud account were suddenly wiped tomorrow, would you be ready to recover? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report

Advertisement

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading

Technology

Hulu, Disney Plus, and the Pixel Watch 4 are among this week’s best deals

Published

on

Hulu, Disney Plus, and the Pixel Watch 4 are among this week’s best deals

Happy Saturday, all! This week, we found a number of deals that should help you unwind and relax over the next few days (and beyond). If you’re planning to stream the Oscars on Sunday, there’s still time to take advantage of a great deal on Hulu and Disney Plus, as well as Google’s latest 4K streaming device. Speaking of Google, you can also currently save $60 on the Pixel Watch 4; there are also savings to be had on microSD Express cards, ice cream makers, and a host of other great tech this weekend. So, without further ado, let’s get to it.

Hulu and Disney Plus recently launched a terrific promo that drops the price of the ad-supported bundle for new and returning subscribers to just $4.99 a month ($8 off) through 11:59AM ET on March 24th. That’s the best deal we’ve seen on the bundle since Black Friday and Cyber Monday, and a great way to stream the 98th Academy Awards without paying full price when they air tomorrow, March 15th, at 7PM ET.

In addition to the aforementioned awards show, Disney’s discounted bundle lets you catch up on 2026 nominees like The Secret Agent, It Was Just An Accident, and Elio. You also get access to the rest of Hulu and Disney’s massive catalog of movies and TV shows, which includes everything from Predator: Badlands and Anora to both seasons of Andor and the upcoming second season of Daredevil: Born Again.

If you want a terrific Android smartwatch to keep tabs on your health and fitness goals, the Google Pixel Watch 4 is down to a new low price. You can currently pick up the Wi-Fi-enabled 41mm model for $289.99 ($60 off) at Amazon and Best Buy, or the larger 45mm variant for $339.99 (also $60 off) via the same retailers (Amazon / Best Buy).

Google’s latest wearable offers a wide range of helpful health and fitness tools, allowing you to track your activity, sleep, blood oxygen levels, and heart rate. It can automatically record certain cardio workouts, while dual-frequency GPS enables more accurate navigation in challenging environments, including cities. Being a Google device, the Watch 4 also integrates well with the company’s various services, with support for apps like Google Maps, Google Wallet, and Google Assistant. You can also make hands-free calls with Google Gemini using the raise-to-talk gesture, which is helpful when you’re out for a run.

Advertisement

While the watch works well with most Android phones, it pairs especially nicely with Pixel devices. Pixel phone owners, for example, can use it as a remote shutter for the Pixel camera and take advantage of features like Recorder, which can generate AI-powered summaries of recordings. As an added plus, the screen and battery are both repairable and replaceable, so you won’t necessarily need to buy a whole new watch if either gets damaged.

While many first-party Nintendo Switch 2 games don’t take up a huge amount of space, storage can fill up quickly if you keep adding to your digital library or buy a lot of third-party games, such as Cyberpunk 2077. That makes this a solid deal, as the Switch 2 is limited to 256GB of built-in storage and requires pricier microSD Express cards for storage expansion. Samsung’s card uses the newer microSD Express standard, which delivers superior read and write speeds to traditional microSD cards, helping reduce load times and speed up larger downloads.

More great deals from this week

Continue Reading
Advertisement

Trending