Loading story…
The QuickLens – Search Screen with Google Lens Chrome extension was removed from the Chrome Web Store after a change in ownership led to a malicious update that turned the previously legitimate, Google-featured extension into a malware delivery and remote code execution platform affecting roughly 7,000 users. Researchers reported the extension was listed for sale on ExtensionHub shortly after its initial release, and ownership later transferred to an unverified entity using support@doodlebuggle.top under “LLC Quick Lens,” with related policy/identity infrastructure moved to low-reputation domains. A subsequent update (version 5.8) introduced a command-and-control (C2) channel and new high-risk permissions, enabling covert script injection and follow-on abuse.
Analysis of the malicious build found it embedded C2 communications to api.extensionanalyticspro[.]top, generated a persistent UUID, fingerprinted victims (including geolocation via Cloudflare trace), and polled for instructions on a recurring interval. The update also added a rules.json configuration and permissions (including declarativeNetRequestWithHostAccess and webRequest) used to strip browser security headers—including CSP, X-Frame-Options, and X-XSS-Protection—to make in-browser script execution easier. Reporting also tied the activity to ClickFix-style social engineering and crypto theft attempts, illustrating how “silent” extension updates and ownership transfers can rapidly weaponize trusted browser add-ons at scale.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
After the malicious behavior was identified, Google removed QuickLens from the Chrome Web Store and automatically disabled the extension for affected users. Security guidance advised users to remove the extension, scan for malware, reset passwords, and move cryptocurrency to new wallets if exposed.
As part of the campaign, QuickLens displayed fake Google Update alerts that lured users into a ClickFix-style infection chain. Windows users were prompted to run a signed malicious executable that led to PowerShell-based remote code execution, and reports indicated macOS users may also have been targeted with info-stealing malware.
Following the v5.8 release, the extension started polling its C2 for JavaScript, storing it locally, and executing it on visited pages. The injected code enabled victim fingerprinting, form and session data theft, credential harvesting, and scraping of services and cryptocurrency wallets.
On February 17, 2026, version 5.8 of the QuickLens Chrome extension was released to roughly 7,000 users. The update added high-risk permissions, introduced command-and-control communications, and removed key browser security protections from web traffic.
After QuickLens was listed for sale on an extension marketplace, ownership transferred to an unverified entity tied to supportdoodlebuggle.top. This ownership change set the stage for the later malicious update.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **malicious Chrome/Chromium extensions** were identified abusing the Chrome Web Store to steal data from users and enterprises. Two previously legitimate extensions—**QuickLens** (`kdenlnncndfnhkognokgfpabgkgehodd`) and **ShotBird** (`gengfhhkjekmlejbhmmopegofnoifnjp`)—reportedly turned malicious after **ownership transfers**, enabling downstream compromise through injected code and data harvesting. In the QuickLens case, researchers reported the malicious update preserved expected functionality while adding capabilities to **strip security headers** (e.g., `X-Frame-Options`) and facilitate script injection that can bypass **Content Security Policy (CSP)** protections, expanding the attacker’s ability to make cross-domain requests and collect sensitive information. Separately, Microsoft reported a campaign of **counterfeit “AI assistant” browser extensions** distributed via the Chrome Web Store (and therefore also impacting Microsoft Edge environments that allow Chrome extensions), which allegedly affected **20,000+ enterprise tenants** and amassed roughly **900,000 installs**. These extensions impersonated legitimate AI productivity tools and harvested **ChatGPT/DeepSeek conversation histories**, visited URLs, and browsing telemetry, staging data for exfiltration to attacker-controlled infrastructure. Another Chrome Web Store threat involved a fake **imToken**-branded extension (“lmΤoken Chromophore”) that masqueraded as a benign tool but redirected victims to phishing infrastructure to steal **seed phrases and private keys**, using tactics like hardcoded remote configuration (via JSONKeeper) and decoy navigation to the legitimate `token.im` site after credential capture.
Jun 29, 2026
Researchers identified a campaign involving **19 malicious browser extensions** distributed through the Google Chrome Web Store and Microsoft Edge Add-ons marketplace, with reported installations exceeding **2.3 million users**. Fourteen extensions were published as apparently legitimate software, while five were acquired from their original developers and later updated with malicious functionality, leaving users unaware that ownership and code had changed. The extensions contacted command-and-control infrastructure to retrieve replaceable modules, bypassed Content Security Policy controls, and injected code into targeted web pages. They could steal credentials, payment data, Facebook and LinkedIn information, browsing history, cryptocurrency assets, and hardware-wallet seed phrases; some also overlaid pages with **ClickFix** lures that impersonated browser-update notices and persuaded victims to run malicious commands, potentially extending compromise beyond the browser.
Sep 26, 2026
A trusted Chrome extension, **Save Image as Type**, was removed after researchers found it had been hijacked and modified to perform **affiliate commission fraud** against more than 1 million users. The malicious code reportedly redirected shopping traffic in the background on sites including **Amazon, Adidas, and Shein**, while the extension continued to function normally, making the abuse difficult for users to notice. Reporting attributes the compromise to a group called **Karma**, which allegedly acquires established browser extensions from their original developers and then injects malicious code to monetize the existing user base. Separate research shows how easily this model can work in practice: browser extensions can be **sold** to new owners, transferring not just code but also user trust and broad permissions. A proof-of-concept described by Annex Security demonstrated that an extension could be purchased cheaply and then repurposed, underscoring the supply-chain risk created when ownership changes are not visible to users. Together, the reporting and research highlight a growing threat in which legitimate extensions become malicious after sale or takeover, allowing attackers to exploit previously trusted add-ons at scale.
Jun 29, 2026