More than a Troy city horse. 🚨

Anyone who has ever installed the QuickLens extension on Chrome quickly removed it. After all, it was reported that this extension was updated, put malware in later. Most recently, Google has removed it from the Chrome Web Store.

.

QuickLens was originally an extension that allows images to be searched through Google Lens directly from the browser, and it used to have about 7,000 users, but the problem arose after the extension was changed owner. Before the release of version 5.8 update on February 17, 2026, this version added a dangerous script, turning the normal-looking extension into malware.

.

Security researchers report that the QuickLens version requests more access to the system and also modifies the security settings of web pages, such as removing certain types of security headers, to make it easier for malicious code to run on different websites. The extension then connects to the attacker's server to receive additional commands or scripts periodically.

.

One of the attack methods used is that ClickFix displays a fake page like a Google update notification to trick users into pressing, for example, downloading a fake update called googleupdate.exe. If the user accidentally runs such a file, the malware may be installed on the machine immediately.

.

In addition to deceiving file downloads, QuickLens also tries to steal important information such as login information, form completion information, as well as information from various scripto bags such as MetaMask, Phantom, Coinbase Wallet, and Trust Wallet. If important information such as seed phrase is extracted, the property in the bag may be stolen.

.

If QuickLens is ever installed, the extension should be removed from Chrome immediately. Scan the malware finder and change all key account passwords. The user of the script moves the property to a new pocket for security.

.

This event is also an important reminder that even an extension from the official Store does not always mean that it is safe. Users should check the installed extension periodically to prevent potential unconscious risks. Even if it is safe at first, it is not guaranteed that it is safe forever.

.

Source: bleepingcomputer

# IT should know # IT News # Includes IT matters # IT