In January 2026, Huntress Senior Security Operations Analyst Tanner Filip observed threat actors using a malicious browser extension to display a fake security warning, claiming the browser had “stopped abnormally” and prompting users to run a “scan” to remediate the threats. Our analysis revealed this campaign is the work of KongTuke, a threat actor we have been tracking since the beginning of 2025. In this latest operation, we identified several new developments: a malicious browser extension called NexShield that impersonates the legitimate uBlock Origin Lite ad blocker, a new ClickFix variant we have dubbed “CrashFix” that intentionally crashes the browser then baits users into running malicious commands, and ModeloRAT, a previously undocumented Python RAT reserved exclusively for domain-joined hosts.
Here you go! https://lemmy.cafe/comment/15393162
Happy to help!
On the clients that were mentioned:
Here’s Thunder
Here’s the dbzer0 web interface
All with proper crossposting menus, anything else you’d like to misrepresent or lie about?
It’s like that’s almost exactly what I mentioned you said, and exactly why I’m commenting proper links to older posts! It fixes the proxying issue you mention to include it in the post, so I’m happy I can be of assistance. I’m still not sure why it’s so upsetting to you when users link back to other posts in the comments, especially when you weren’t the first one to post it. It helps drive conversation when people know it’s happening elsewhere.
Not sure why you’d want to forward traffic to an instance who has admins that are transphobic and push Russian propaganda but you do you, I can’t stop you :)
I didn’t just link to ML, but go off! I’m not the one crossposting the content in the first place, I wouldn’t have linked to ML if that wasn’t where you got the post to begin with. Nice of you to bring up transphobia in an argument against a trans person, though!
Well this is what Nutomic, second head Lemmy dev and .ml admin has to say about the LGBTQ+ movement [Transphobia CW] https://lemmy.world/post/18236068
I don’t care what transphobes have to say, I’ve heard it all before. At least I don’t crosspost content from the land of transphobes, though! You enjoying having your feed be filled with ML content even though you claim to boycott them?
Taking content from them, doesn’t support their instance in any way. Upvoting, commenting and posting on comms on their instance does. Which I don’t do and by cross-posting content away onto non.ml comms it reduces their activity bit by bit but revitalizing other similar comms
But by your logic, the built in crosspost functionality is no worse than what I’ve done, right? Since the crosspost links always work, therefore you also linked to ML?