{"id":"quicklens-chrome-extension-poisoned-feb-2026","category":"supply-chain","status":"closed","title":"QuickLens Chrome extension poisoned after ownership transfer; fake updates and crypto-theft attempts","tldr":"QuickLens, a Chrome extension with about 7,000 users, turned malicious in version 5.8 after changing owners. Chrome reportedly disabled it. Remove it, scan for malware and reset exposed passwords; wallet users should seek help securing their funds.","summary":"QuickLens – Search Screen with Google Lens was a working browser extension with approximately 7,000 users before an ownership change preceded malicious version 5.8 on 17 February. Annex found that the update removed website security headers and ran remotely supplied scripts on visited pages. BleepingComputer subsequently documented fake Google update prompts leading to Windows malware, alongside scripts targeting cryptocurrency wallet recovery phrases, passwords, payment details and other browser data. Users reported encountering the prompts, so this was an active campaign. By 28 February, BleepingComputer reported that Google had removed the extension and Chrome was automatically disabling it. That containment does not establish that affected computers or accounts are clean. As at 3 November, the sources reviewed document no clean replacement release, confirmed cryptocurrency loss total or recovery. No incident-specific statement from Google or QuickLens was found; removal and disabling are supported by reporting rather than a direct company statement.","action":"In Chrome, open Extensions → Manage extensions and remove QuickLens – Search Screen with Google Lens, even if disabled. Scan the computer for malware and reset potentially exposed passwords from a clean device; if you followed a fake update prompt, ask a trusted technician to check the computer. If you used a cryptocurrency wallet while QuickLens was active, seek trusted help moving funds to a newly created wallet with a new recovery phrase.","product":"QuickLens – Search Screen with Google Lens browser extension","audience":"both","severity":"high","patch":"none","exploited":true,"cves":[],"tags":["quicklens","chrome","browser-extension","supply-chain","malware","crypto","credential-theft"],"affected":["QuickLens – Search Screen with Google Lens version 5.8, identified as malicious by Annex; extension ID kdenlnncndfnhkognokgfpabgkgehodd"],"fixed":[],"matches":[{"platform":"chrome","app":"QuickLens - Search Screen with Google Lens","bundle":"kdenlnncndfnhkognokgfpabgkgehodd","fixed":""}],"sources":[{"kind":"advisory","title":"Install and manage extensions — general removal guidance, not a QuickLens incident statement","url":"https://support.google.com/chrome/answer/2664769?hl=en","by":"Google","date":""},{"kind":"research","title":"Pixel Perfect: Sold Extension Injects Code Through Pixel","url":"https://secureannex.com/blog/pixel-perfect/","by":"Annex","date":"2026-02-23"},{"kind":"news","title":"QuickLens Chrome extension steals crypto, shows ClickFix attack","url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","by":"BleepingComputer","date":"2026-02-28"},{"kind":"news","title":"Chrome extension ‘QuickLens’ removed after stealing crypto and spreading malware","url":"https://www.scworld.com/brief/malicious-chrome-extension-quicklens-removed-after-stealing-crypto-and-spreading-malware","by":"SC Media","date":"2026-03-02"},{"kind":"news","title":"Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft","url":"https://thehackernews.com/2026/03/chrome-extension-turns-malicious-after.html","by":"The Hacker News","date":"2026-03-09"},{"kind":"advisory","title":"Chrome Extension Turns Malicious After Ownership Transfer","url":"https://www.cirt.gov.jm/advisory/chrome-extension-turns-malicious-after-ownership-transfer","by":"Jamaica Cyber Incident Response Team","date":"2026-03-10"}],"started":"2026-02-17","closed":"2026-03-10","created":"2026-11-03T21:52:20.324Z","updated":"2026-11-03T21:52:20.324Z","cve_notes":[],"timeline":[{"at":"2026-03-10","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Jamaica's Cyber Incident Response Team issued advisory JMCIRT-SA-2026-009 naming QuickLens as compromised. It recommended removing affected extensions and resetting sensitive-account passwords where exposure was possible.","url":"https://www.cirt.gov.jm/advisory/chrome-extension-turns-malicious-after-ownership-transfer","by":"Jamaica Cyber Incident Response Team","patch":null},{"at":"2026-02-28","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"BleepingComputer documented fake Google update prompts, Windows malware delivery and scripts targeting wallet recovery phrases and sensitive browser data. It reported that Google had removed QuickLens from the Chrome Web Store and Chrome was automatically disabling it.","url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","by":"BleepingComputer","patch":null},{"at":"2026-02-23","added":"2026-11-03T21:45:10.669Z","kind":"disclosed","text":"Annex published its investigation into the ownership transfer and malicious update. QuickLens had approximately 7,000 users.","url":"https://secureannex.com/blog/pixel-perfect/","by":"Annex","patch":null},{"at":"2026-02-17","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"QuickLens version 5.8 introduced malicious functionality while retaining its image-search features. It removed website security headers and ran scripts supplied by an external server on visited pages.","url":"https://secureannex.com/blog/pixel-perfect/","by":"Annex","patch":"none"},{"at":"2026-02-01","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Annex recorded a new owner for QuickLens, listed as LLC Quick Lens, following its earlier listing for sale on an extension marketplace.","url":"https://secureannex.com/blog/pixel-perfect/","by":"Annex","patch":null}],"url":"https://hard.fyi/live/quicklens-chrome-extension-poisoned-feb-2026/","json":"https://hard.fyi/api/live?id=quicklens-chrome-extension-poisoned-feb-2026"}