NEW CLICKFIX VARIANT 'CRASHFIX' DEPLOYING PYTHON REMOTE ACCESS TROJAN

Summary from the TLDR InfoSec newsletter

Microsoft identified a new ClickFix variant dubbed "CrashFix" that uses a malicious Chrome extension impersonating uBlock Origin Lite to deliberately crash victims' browsers, then tricks users into executing clipboard-copied commands via a fake security warning. The attack chain abuses the legitimate Windows utility finger.exe (renamed to ct.exe) to retrieve obfuscated PowerShell payloads, ultimately deploying a Python-based RAT called ModeloRAT that selectively targets domain-joined enterprise systems for further compromise. ModeloRAT beacons to hardcoded C2 servers over HTTP, establishes persistence via registry Run keys and scheduled tasks, and conducts network reconnaissance using native Windows commands like nltest and net use.