Malicious Chrome Extension Targets Crypto Users

A malicious Chrome extension, QuickLens - Search Screen with Google Lens, was removed from the Chrome Web Store after it was compromised to steal cryptocurrency from thousands of users. The extension, which allowed users to run Google Lens searches directly in their browser, had gained a significant following, with around 7,000 users and a featured badge from Google.

However, on February 17, 2026, a new version (5.8) of the extension was released, containing malicious scripts that introduced ClickFix attacks and info-stealing functionality. This development marked a significant turning point in the extension's history, transforming it from a legitimate tool to a malicious entity.

According to security researchers at Annex, the extension's ownership changed hands on February 1, 2026, when it was listed for sale on ExtensionHub, a marketplace where developers sell browser extensions. The new owner, listed as support@doodlebuggle.top under "LLC Quick Lens," updated the extension's privacy policy, hosting it on a barely functional domain.

The malicious version of the extension was designed to target cryptocurrency users, attempting to steal their sensitive information and assets. The ClickFix attack, a type of malware, was used to deceive users into divulging their login credentials and other sensitive data.

The compromise of QuickLens highlights the risks associated with third-party browser extensions. While these extensions can provide useful functionality, they can also pose significant security risks if not properly vetted and maintained.

Google's Chrome Web Store has faced criticism in the past for its handling of malicious extensions. In 2020, the company removed over 500 malicious extensions from the store after they were found to be stealing user data and executing malicious scripts.

The incident serves as a reminder for users to exercise caution when installing browser extensions, even those with high ratings and large user bases. It is essential to carefully review an extension's permissions, read user reviews, and monitor its behavior for any suspicious activity.

In response to the incident, Google removed the malicious extension from the Chrome Web Store, and users are advised to uninstall the extension and reset their browser settings. The company has also taken steps to improve its extension review process, including the use of artificial intelligence and machine learning to detect malicious activity.

As the use of browser extensions continues to grow, it is crucial for developers, users, and platform providers to prioritize security and work together to prevent similar incidents in the future.

In the wake of the QuickLens compromise, users are advised to remain vigilant and take steps to protect themselves from malicious extensions. This includes:

• Carefully reviewing an extension's permissions and user reviews before installation
• Monitoring extension behavior for suspicious activity
• Keeping browser and extension software up to date
• Using strong, unique passwords and enabling two-factor authentication
• Regularly scanning for malware and other security threats

By taking these precautions, users can reduce the risk of falling victim to malicious browser extensions and protect their sensitive information and assets.