Fake Ad Blocker NexShield Launches Dangerous ClickFix Attack
2 minutes read
A malicious ad-blocking extension called NexShield has been discovered targeting Chrome and Edge users with a sophisticated ClickFix attack. Although NexShield claimed to be privacy-focused and linked itself to the reputable uBlock Origin, cybersecurity experts found it initiates a variation of the “CrashFix” attack. This involves forcing the browser into a denial-of-service (DoS) loop, exhausting system memory until Chrome or Edge crashes, then displaying a fake security warning with a “Run Scan” button.
If users follow the prompts, NexShield tricks them into running a copied command in their Windows command prompt. This social engineering tactic, known as ClickFix, ultimately downloads and executes a malicious script. After a 60-minute delay to avoid detection, the extension deploys a payload capable of spying on the system, running commands, fingerprinting, and escalating privileges.
- NexShield has now been removed from the Chrome Web Store, but users who installed it should immediately uninstall the extension and perform a thorough malware scan.
- To stay safe from similar threats, always verify browser extensions by checking their creation date, reviews, and permissions, and avoid running unfamiliar commands from pop-ups or websites.
We publish practical informational articles based on publicly available sources, summarizing key ideas, explanations, and useful context to help readers quickly understand a topic. Each article is reviewed prior to publication to improve clarity, accuracy, and usefulness.