Malicious Chrome Extension “CrashFix” Used for Initial Access and Malware Delivery

Analysis

Threat Overview

CrashFix is a malicious Chrome extension masquerading as a legitimate ad blocker or browser utility. Once installed, it delays execution to evade detection, then intentionally destabilizes the browser by consuming excessive resources.

The resulting crashes are used as a social engineering tactic, displaying fake “CrashFix” alerts that instruct users to perform remediation steps. These steps ultimately lead to execution of attacker-controlled commands.

Attack Chain

1. User installs a fake browser extension posing as a legitimate tool

2. Extension remains dormant to avoid early detection

3. Browser crashes are intentionally triggered

4. Fake error messages prompt user interaction

5. Malicious commands are executed

6. Additional payloads may be deployed (e.g., ModeloRAT)

Impact

• Initial access via trusted browser extensions

• Potential remote access to infected systems

• Higher risk on domain-joined or enterprise-managed endpoints

• Data exfiltration and persistent access possible

Detection Recommendations

• Monitor for unauthorized browser extension installations

• Investigate repeated or unexplained browser crashes

• Correlate browser instability with endpoint command execution

• Watch for outbound connections to low-reputation or newly registered domains

• Treat browser extensions as executable code within threat models

Mitigation

• Enforce browser extension allowlisting

• Remove suspicious extensions immediately

• Block known malicious hashes and extension IDs

• Educate users to ignore browser pop-ups instructing command execution

Remediation

Remediation Steps

Immediate Actions

1. Identify and remove the malicious extension

   • Uninstall any browser extension with ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi

   • Review all installed extensions for unknown publishers or excessive permissions.

2. Isolate affected endpoints

   • Temporarily remove impacted systems from the network to prevent lateral movement or C2 communication.

3. Block known malicious artifacts

   • Add the following SHA256 hashes to EDR, AV, and SIEM blocklists:

     • c46af9ae6ab0e7567573dbc950a8ffbe30ea848fac90cd15860045fe7640199c

     • fbfce492d1aa458c0ccc8ce4611f0e2d00913c8d51b5016ce60a7f59db67de67

     • 6399c686eba09584bbbb02f31d398ace333a2b57529059849ef97ce7c27752f4

     • c15f44d6abb3a2a882ffdc9b90f7bb5d1a233c0aa183eb765aa8bfba5832c8c6

4. Terminate suspicious processes

   • Investigate and kill any unauthorized Python or .NET processes spawned shortly after browser crashes.

Short-Term Hardening

1. Reset affected browsers

   • Clear browser cache, extensions, and profiles.

   • Reinstall browsers if integrity cannot be verified.

2. Audit persistence mechanisms

   • Check scheduled tasks, registry run keys, startup folders, and services for unauthorized entries.

3. Review command execution logs

   • Investigate PowerShell, CMD, or script execution triggered by user interaction with fake browser alerts.

Long-Term Preventive Controls

1. Enforce browser extension allowlisting

   • Restrict installations to approved extensions using Group Policy or MDM controls.

2. Strengthen user awareness

   • Train users to distrust browser pop-ups requesting command execution or system-level fixes.

3. Enhance monitoring

   • Treat repeated browser crashes as a potential security signal.

   • Correlate browser events with endpoint and network telemetry.

4. Review endpoint privileges

   • Ensure users do not have unnecessary local admin rights that could accelerate compromise.

Recovery & Validation

1. Run full endpoint scans

   • Use EDR/AV tools to ensure no secondary payloads remain.

2. Change credentials if required

   • Rotate credentials for users on confirmed infected systems.

3. Document and report

   • Record findings, timelines, and remediation actions.

   • Update threat intelligence repositories and detection rules.