Security researchers have identified a fake ad-blocker extension that causes web browsers to crash repeatedly and then pushes users into completing tasks from “ClickFix”-style popups. The extension appears legitimate but is designed to drive traffic to scam pages and potentially expose users to fraud or malware.
How the fake extension works
The malicious extension masquerades as an ad-blocker but injects harmful scripts into webpages. When activated, it can destabilise the browser, causing frequent crashes or redirects. After a crash loop, users are shown “ClickFix” pages that prompt them to complete surveys, install software, or provide personal information to “fix” the issue.
ClickFix pop-up behaviour
ClickFix scams use fake warnings and demand that users perform tasks, such as filling out forms, enabling notifications, or downloading software, under the pretense of restoring normal browser function. These tasks often benefit the attacker by generating revenue, harvesting data, or leading to additional malicious installs.
Risk to users
Users of the fake extension risk being tricked into giving up personal data, signing up for paid subscriptions, or installing unwanted software. The behaviour can also degrade device performance or expose the system to further threats if additional malware is delivered.
Detection and removal
Security researchers recommend removing the extension immediately and scanning the system with trusted anti-malware tools. Users should also reset affected browsers and clear cache data to stop redirects and popup loops.
Prevention tips
To avoid similar threats, install extensions only from official stores with verified publishers and check user reviews and ratings. Keep browsers and extensions updated, and be cautious of tools that request broad permissions not needed for their function.
Conclusion
A fake ad-blocker extension is crashing browsers and directing users to “ClickFix” scams that push tasks and potentially harmful content. Removing the extension and using trusted sources for add-ons can help protect against this and similar threats.
