QuickLens Chrome extension poisoned after ownership transfer; fake updates and crypto-theft attempts
QuickLens, a Chrome extension with about 7,000 users, turned malicious in version 5.8 after changing owners. Chrome reportedly disabled it. Remove it, scan for malware and reset exposed passwords; wallet users should seek help securing their funds.
In Chrome, open Extensions → Manage extensions and remove QuickLens – Search Screen with Google Lens, even if disabled. Scan the computer for malware and reset potentially exposed passwords from a clean device; if you followed a fake update prompt, ask a trusted technician to check the computer. If you used a cryptocurrency wallet while QuickLens was active, seek trusted help moving funds to a newly created wallet with a new recovery phrase.
- QuickLens - Search Screen with Google Lensno fixed version yet
What’s happening
QuickLens – Search Screen with Google Lens was a working browser extension with approximately 7,000 users before an ownership change preceded malicious version 5.8 on 17 February. Annex found that the update removed website security headers and ran remotely supplied scripts on visited pages. BleepingComputer subsequently documented fake Google update prompts leading to Windows malware, alongside scripts targeting cryptocurrency wallet recovery phrases, passwords, payment details and other browser data. Users reported encountering the prompts, so this was an active campaign. By 28 February, BleepingComputer reported that Google had removed the extension and Chrome was automatically disabling it. That containment does not establish that affected computers or accounts are clean. As at 3 November, the sources reviewed document no clean replacement release, confirmed cryptocurrency loss total or recovery. No incident-specific statement from Google or QuickLens was found; removal and disabling are supported by reporting rather than a direct company statement.
- What
- Poisoned software
- Affects
- QuickLens – Search Screen with Google Lens browser extension
- Affected
- QuickLens – Search Screen with Google Lens version 5.8, identified as malicious by Annex; extension ID kdenlnncndfnhkognokgfpabgkgehodd
- Fixed in
- No fix yet
- Since
- 17 Feb 2026
- Closed
- 10 Mar 2026
Timeline
- Update
Jamaica's Cyber Incident Response Team issued advisory JMCIRT-SA-2026-009 naming QuickLens as compromised. It recommended removing affected extensions and resetting sensitive-account passwords where exposure was possible.
- Update
BleepingComputer documented fake Google update prompts, Windows malware delivery and scripts targeting wallet recovery phrases and sensitive browser data. It reported that Google had removed QuickLens from the Chrome Web Store and Chrome was automatically disabling it.
- Made public
Annex published its investigation into the ownership transfer and malicious update. QuickLens had approximately 7,000 users.
- UpdateNo fix yet
QuickLens version 5.8 introduced malicious functionality while retaining its image-search features. It removed website security headers and ran scripts supplied by an external server on visited pages.
- Update
Annex recorded a new owner for QuickLens, listed as LLC Quick Lens, following its earlier listing for sale on an extension marketplace.
Sources
- Install and manage extensions — general removal guidance, not a QuickLens incident statementGoogle
- Pixel Perfect: Sold Extension Injects Code Through PixelAnnex · 23 Feb 2026
- QuickLens Chrome extension steals crypto, shows ClickFix attackBleepingComputer · 28 Feb 2026
- Chrome extension ‘QuickLens’ removed after stealing crypto and spreading malwareSC Media · 2 Mar 2026
- Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data TheftThe Hacker News · 9 Mar 2026
- Chrome Extension Turns Malicious After Ownership TransferJamaica Cyber Incident Response Team · 10 Mar 2026