this post was submitted on 20 Jan 2026
4 points (83.3% liked)

cybersecurity

5464 readers
19 users here now

An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!

Community Rules

Enjoy!

founded 2 years ago
MODERATORS
 

In January 2026, Huntress Senior Security Operations Analyst Tanner Filip observed threat actors using a malicious browser extension to display a fake security warning, claiming the browser had "stopped abnormally" and prompting users to run a “scan” to remediate the threats. Our analysis revealed this campaign is the work of KongTuke, a threat actor we have been tracking since the beginning of 2025. In this latest operation, we identified several new developments: a malicious browser extension called NexShield that impersonates the legitimate uBlock Origin Lite ad blocker, a new ClickFix variant we have dubbed “CrashFix” that intentionally crashes the browser then baits users into running malicious commands, and ModeloRAT, a previously undocumented Python RAT reserved exclusively for domain-joined hosts.

you are viewing a single comment's thread
view the rest of the comments
[–] cm0002@lemmings.world 0 points 4 days ago (1 children)
[–] AmbiguousProps@lemmy.today 0 points 4 days ago (1 children)

Just connecting the fediverse as you claimed to be doing with your mass reposting!

[–] cm0002@lemmings.world 0 points 4 days ago (1 children)

Already handled by the internal crosspost system

[–] AmbiguousProps@lemmy.today 0 points 4 days ago (1 children)

Not for all frontends, as multiple people have told you in the past. I'm not going down that route again, but I sure will continue to help those that can't see that you're just crossposting from elsewhere.

[–] cm0002@lemmings.world 0 points 4 days ago* (last edited 4 days ago) (1 children)

There's no such app or frontend, they all have the crosspost menu afaik, if you know of one, lmk even though you still haven't. You just keep making that claim without actually answering lol

[–] AmbiguousProps@lemmy.today 0 points 4 days ago (1 children)
[–] cm0002@lemmings.world 1 points 4 days ago (1 children)

It has to do with the proxying URLs on images [A rare instance related issue]

On the clients that were mentioned:

Here's Thunder

Here's the dbzer0 web interface

All with proper crossposting menus, anything else you'd like to misrepresent or lie about?

[–] AmbiguousProps@lemmy.today 0 points 4 days ago* (last edited 4 days ago) (1 children)

It's like that's almost exactly what I mentioned you said, and exactly why I'm commenting proper links to older posts! It fixes the proxying issue you mention to include it in the post, so I'm happy I can be of assistance. I'm still not sure why it's so upsetting to you when users link back to other posts in the comments, especially when you weren't the first one to post it. It helps drive conversation when people know it's happening elsewhere.

[–] cm0002@lemmings.world 0 points 4 days ago (1 children)

Not sure why you'd want to forward traffic to an instance who has admins that are transphobic and push Russian propaganda but you do you, I can't stop you :)

[–] AmbiguousProps@lemmy.today 0 points 4 days ago* (last edited 4 days ago) (1 children)

I didn't just link to ML, but go off! I'm not the one crossposting the content in the first place, I wouldn't have linked to ML if that wasn't where you got the post to begin with. Nice of you to bring up transphobia in an argument against a trans person, though!

[–] cm0002@lemmings.world 0 points 4 days ago (1 children)

Nice of you to bring up transphobia in an argument against a trans person, though!

Well this is what Nutomic, second head Lemmy dev and .ml admin has to say about the LGBTQ+ movement [Transphobia CW] https://lemmy.world/post/18236068

[–] AmbiguousProps@lemmy.today 0 points 4 days ago* (last edited 4 days ago) (1 children)

I don't care what transphobes have to say, I've heard it all before. At least I don't crosspost content from the land of transphobes, though! You enjoying having your feed be filled with ML content even though you claim to boycott them?

[–] cm0002@lemmings.world 1 points 4 days ago (1 children)

Taking content from them, doesn't support their instance in any way. Upvoting, commenting and posting on comms on their instance does. Which I don't do and by cross-posting content away onto non.ml comms it reduces their activity bit by bit but revitalizing other similar comms

[–] AmbiguousProps@lemmy.today 0 points 4 days ago (1 children)

But by your logic, the built in crosspost functionality is no worse than what I've done, right? Since the crosspost links always work, therefore you also linked to ML?

[–] cm0002@lemmings.world 0 points 4 days ago (1 children)

They display, in a separate submenu, increasing friction. It's well known in human behavior/UI design that every additional click for the average user reduces the likelihood they're just going to click it for no reason

[–] AmbiguousProps@lemmy.today 0 points 4 days ago (1 children)

That's not really friction, and in fact, on the standard Lemmy UI, it's not in a submenu at all..it's just straight up linked under the post title. No extra click required. So what's the difference?

[–] cm0002@lemmings.world 0 points 4 days ago (1 children)

Well sure, it's not foolproof, but the vast majority of users are probably not using the default Lemmy UI (because it kinda sucks lol) and instead are using an app or other front end.

[–] AmbiguousProps@lemmy.today 0 points 4 days ago

People should know that you're crossposting from transphobic instances, in my opinion, so I'll continue letting people know, especially for those using screen readers. Also, I use the default Lemmy UI almost daily.