QuickLens Chrome extension went malicious after a sale, pushing ClickFix and crypto theft
After an ownership change, QuickLens 5.8 stripped CSP headers, ran remote JS on every page and pushed a fake Google update. What happened and what to check.
A Chrome extension with about 7,000 users, "QuickLens - Search Screen with Google Lens", became malware roughly two weeks after it changed hands. Version 5.8 removed security headers from every site the user visited, pulled JavaScript from a command server, and used a fake Google update prompt to get Windows users to run a malware loader. For developers this is a reminder that browser extensions are a supply chain that updates silently, and that your site's Content Security Policy can't protect users whose browser has been altered.
What happened
Annex Security first flagged the extension, and BleepingComputer published its own analysis on 28 February 2026. The timeline:
- 1 February 2026. The listing's owner changed to
[email protected]under the name "LLC Quick Lens", with a new privacy policy. Annex says the extension had been listed for sale on ExtensionHub, a marketplace for browser extensions. - 17 February 2026. Version 5.8 was released with new permissions (
declarativeNetRequestWithHostAccess,webRequest) and arules.jsonthat removedContent-Security-Policy,X-Frame-OptionsandX-XSS-Protectionheaders from all pages and frames. - By 28 February. Google had removed the extension from the Chrome Web Store, and Chrome disabled it for existing users.
Once installed, the extension contacted api.extensionanalyticspro[.]top, created a persistent ID, reported the victim's country, browser and OS, and checked for instructions every five minutes. Payloads arrived as JavaScript strings and ran on every page load through what Annex called a "1x1 GIF pixel onload trick". The first payload showed a fake Google Update prompt from google-update[.]icu. Users who clicked through were shown a ClickFix-style "verification" step that told them to run code. On Windows this delivered googleupdate.exe, signed with a certificate issued to "Hubei Da'e Zhidao Food Technology Co., Ltd.". It launched hidden PowerShell, which fetched and ran a second stage from drivers[.]solutions.
The injected scripts targeted data from MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Solflare, Backpack, Brave Wallet, Exodus, Binance Chain Wallet, WalletConnect and Argon, including seed phrases. They also targeted login credentials, payment details and other form input, Gmail inbox contents, Facebook Business Manager ad accounts and YouTube channel data.
Who is affected
- Anyone who had QuickLens installed when version 5.8 or later was active, especially Windows users who followed the fake update prompt.
- Crypto wallet users of the extensions listed above in the same browser profile.
- Organizations that allow unrestricted extension installs on managed browsers. A removed listing claimed Mac users were targeted with the Atomic (AMOS) stealer, but BleepingComputer could not confirm this.
What it means for developers and engineering teams
The technique that matters most to web developers is header stripping with declarativeNetRequest. A Manifest V3 extension with host access can rewrite response headers before the page sees them. That means your carefully tuned CSP, frame protections and similar headers can disappear for that user, and script injection you would normally block will run. Server-side security headers protect users from other sites. They can't protect users from their own compromised browser. Defences that keep working in that situation live elsewhere: phishing-resistant authentication (passkeys and WebAuthn bind to the real origin), server-side transaction confirmation, and anomaly detection on sessions.
The second lesson is about ownership transfers. Extensions auto-update, and the store keeps the existing user base, ratings and even "featured" badges when a listing changes hands. Buying an extension and shipping a malicious update is cheaper than building trust from scratch. Treat extensions like any other third-party dependency: pin them to a short allowlist, review new permission requests, and watch for publisher changes.
Finally, ClickFix works because it gets the user to run the code. No browser exploit is needed. Any page that asks you to paste something into Run, PowerShell or Terminal to "verify" or "update" should be treated as an attack.
What to do now
- Remove QuickLens if it is still present, and run a full malware scan on any machine where it was installed.
- Reset passwords saved in that browser and revoke active sessions for Gmail, Facebook Business and YouTube.
- Move crypto funds to a new wallet with a new seed phrase if you used any of the targeted wallets in that profile.
- Enforce an extension allowlist on managed Chrome with the
ExtensionInstallBlocklistset to*and approved IDs inExtensionInstallAllowlist. - Hunt for indicators: DNS lookups for
extensionanalyticspro[.]top,google-update[.]icuanddrivers[.]solutions, agoogleupdate.exeoutside Google's install paths, and PowerShell usingInvoke-Expressionon downloaded content. - Train people on ClickFix: no real update or CAPTCHA ever asks you to paste commands into a shell.