How the QuickLens Chrome Extension Became a Sophisticated Cybercrime Tool

A seemingly routine browser extension update can sometimes open the floodgates to sophisticated cybercrime. The QuickLens Chrome extension, once a trusted tool for users, became a cautionary tale after a rapid ownership transfer led to a malicious overhaul. Within weeks, attackers transformed QuickLens into a vehicle for crypto theft and advanced social engineering, exploiting both browser vulnerabilities and user trust. The attackers’ playbook included expanding permissions, stripping away browser security headers, and deploying a persistent command-and-control infrastructure. Their pièce de résistance? The ClickFix attack—a fake Google Update prompt that tricked users into running malware, all while targeting both Windows and macOS platforms. This incident underscores how browser extensions, when compromised, can bypass even the most robust security measures and highlights the urgent need for vigilance in extension management.

How the QuickLens Extension Was Compromised: A Deep Dive into Permissions, Payloads, and ClickFix Scams

Ownership Change and Malicious Update Timeline

The compromise of the QuickLens Chrome extension can be traced to a pivotal event: the transfer of ownership. On February 1, 2026, QuickLens changed hands, with the new owner registered as support@doodlebuggle.top under the entity “LLC Quick Lens.” This transition was facilitated through ExtensionHub, a marketplace for browser extensions. The new owner promptly updated the privacy policy, hosting it on a minimally functional domain. Within just over two weeks, a malicious update (version 5.8) was released, marking a significant shift in the extension’s behavior from benign to overtly malicious.

This timeline underscores the speed with which threat actors can weaponize a legitimate browser extension after acquiring control.

Expansion of Browser Permissions and Security Bypass

A critical aspect of the compromise was the expansion of browser permissions requested by QuickLens in its malicious update. The extension sought elevated privileges, including declarativeNetRequestWithHostAccess and webRequest. These permissions enabled the extension to intercept, modify, and manipulate network requests across all browser sessions.

Additionally, the update included a rules.json file that systematically stripped essential browser security headers from all web pages and frames. The targeted headers included:

• Content-Security-Policy (CSP): Prevents the execution of unauthorized scripts.
• X-Frame-Options: Protects against clickjacking by controlling frame embedding.
• X-XSS-Protection: Mitigates certain cross-site scripting attacks.

By removing these headers, the extension effectively neutralized browser-level defenses, allowing for unrestricted execution of malicious scripts—even on websites that would otherwise block such activity. This manipulation of browser security architecture is a hallmark of sophisticated extension-based attacks.

Command-and-Control Infrastructure and Victim Profiling

The malicious QuickLens extension established persistent communication with a command-and-control (C2) server at api.extensionanalyticspro[.]top. Upon installation, the extension generated a unique identifier (UUID) for each victim, fingerprinted the user’s country using Cloudflare’s trace endpoint, and identified both the browser and operating system.

The extension polled the C2 server every five minutes, requesting new instructions and payloads. This polling mechanism allowed the attackers to dynamically update the malicious behaviors and tailor attacks based on the victim’s environment. The persistent UUID enabled long-term tracking of individual users, facilitating targeted data exfiltration and attack customization.

Payload Delivery Mechanisms and Inline Script Execution

A defining technical innovation in the QuickLens compromise was the method of payload delivery and execution. The extension utilized a “1x1 GIF pixel onload trick” to inject and execute malicious JavaScript on every page load. This technique, combined with the removal of CSP headers, ensured that injected scripts would run even on sites with stringent security policies.

The initial payloads fetched from the C2 server included scripts designed to:

• Detect the presence of popular cryptocurrency wallets (e.g., MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Solflare, Backpack, Brave Wallet, Exodus, Binance Chain Wallet, WalletConnect, Argon).
• Attempt to steal wallet activity and seed phrases.
• Capture login credentials, payment information, and sensitive form data.
• Scrape Gmail inbox contents, Facebook Business Manager advertising account data, and YouTube channel information.

This multi-pronged approach maximized the extension’s potential for data theft and account compromise.

ClickFix Attack Vector and Social Engineering Tactics

One of the most insidious aspects of the QuickLens compromise was its use of the ClickFix attack vector. The extension delivered a fake Google Update prompt on every web page visited by the victim. This prompt, fetched from the C2 server, instructed users to perform a “verification” by running code on their computers—an example of advanced social engineering.

For Windows users, clicking the update button initiated the download of a malicious executable named googleupdate.exe, which was signed with a certificate from “Hubei Da’e Zhidao Food Technology Co., Ltd.” Upon execution, this file launched a hidden PowerShell command that connected to a remote server and executed further malicious payloads using the “Katzilla” user agent. The attackers also leveraged additional JavaScript agents to steal cryptocurrency wallets and credentials.

The extension’s ability to crash browsers, display fake fixes, and prompt users to execute malicious code demonstrates the evolving sophistication of browser extension-based scams. This attack chain not only bypassed technical defenses but also exploited user behavior, making it particularly effective.

Multi-Platform Targeting and Secondary Payloads

While Windows users were targeted with executable-based payloads, reports indicated that macOS users may have been targeted with the AMOS (Atomic Stealer) infostealer, although independent verification was pending at the time of reporting. The extension’s design allowed for platform-specific payload delivery, further broadening its impact.

The attackers also scraped a wide array of data beyond cryptocurrency, including:

• Gmail inbox content
• Facebook Business Manager advertising account data
• YouTube channel information

This comprehensive data harvesting strategy increased the potential for downstream attacks, such as business email compromise, social media account takeovers, and targeted phishing.

Summary Table: Key Technical Elements of the QuickLens Compromise

The QuickLens incident exemplifies the dangers posed by compromised browser extensions, particularly when attackers combine technical subversion with sophisticated social engineering. The rapid escalation from ownership transfer to widespread malware distribution highlights the necessity for continuous monitoring, robust extension vetting, and user education regarding browser security.

Final Thoughts

The QuickLens compromise is a stark reminder that browser extensions, while convenient, can become potent attack vectors almost overnight. The attackers’ blend of technical subversion—like permission escalation and security header removal—with clever social engineering tactics such as the ClickFix prompt, demonstrates a new level of sophistication in extension-based threats. For users and organizations alike, this incident highlights the importance of scrutinizing extension updates, monitoring for unusual permission requests, and fostering a healthy skepticism toward unexpected prompts or downloads. As browser ecosystems continue to evolve, so too must our strategies for defending against these rapidly emerging threats.

References

• BleepingComputer. (2026). QuickLens Chrome extension steals crypto, shows ClickFix attack. https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/