In January 2026, Huntress Senior Security Operations Analyst Tanner Filip observed threat actors using a malicious browser extension to display a fake security warning, claiming the browser had “stopped abnormally” and prompting users to run a “scan” to remediate the threats. Our analysis revealed this campaign is the work of KongTuke, a threat actor we have been tracking since the beginning of 2025. In this latest operation, we identified several new developments: a malicious browser extension called NexShield that impersonates the legitimate uBlock Origin Lite ad blocker, a new ClickFix variant we have dubbed “CrashFix” that intentionally crashes the browser then baits users into running malicious commands, and ModeloRAT, a previously undocumented Python RAT reserved exclusively for domain-joined hosts.
That’s not really friction, and in fact, on the standard Lemmy UI, it’s not in a submenu at all…it’s just straight up linked under the post title. No extra click required. So what’s the difference?
Well sure, it’s not foolproof, but the vast majority of users are probably not using the default Lemmy UI (because it kinda sucks lol) and instead are using an app or other front end.
People should know that you’re crossposting from transphobic instances, in my opinion, so I’ll continue letting people know, especially for those using screen readers. Also, I use the default Lemmy UI almost daily.