Hijacked QuickLens Chrome Extension Pushes ClickFix Malware, Targets Crypto Wallets
Summary
QuickLens v5.8 was reportedly hijacked and used to push ClickFix prompts and infostealer payloads to about 7,000 users, targeting crypto wallets and credentials. Google removed the extension; reported theft was not confirmed.
Key points
- The extension changed ownership before a malicious v5.8 update was released on February 17, 2026, reaching roughly 7,000 users.
- The update added browser permissions and stripped CSP and other security headers, enabling scripts to run on visited pages.
- According to Annex, QuickLens fingerprinted users and polled api.extensionanalyticspro[.]top every five minutes for instructions.
- Injected scripts displayed fake Google Update prompts that led to ClickFix instructions; a Windows payload launched hidden PowerShell commands.
- The extension attempted to steal crypto wallet seed phrases and credentials, and also collected other sensitive account data.
- The article says a payload URL at drivers[.]solutions was no longer serving malicious content when BleepingComputer analyzed it; claims that macOS users received AMOS were not independently verified.
- Google removed QuickLens and Chrome automatically disables it. Users were advised to remove it, scan devices, reset browser-stored passwords, and move wallet funds.
Article Details
- Victim Organization
- QuickLens extension and its users
- Victim Domain
- Not disclosed
- Incident Type
- Compromised Chrome extension update delivering ClickFix prompts and infostealer payloads, with attempted credential and cryptocurrency-wallet theft
- Incident Date
- 2026-02-17
- Data Types Exposed
- Browser-stored credentials and sensitive form data (targeted for theft; actual theft not confirmed)
- Cryptocurrency wallet activity and seed phrases (targeted for theft; actual theft not confirmed)
- Gmail inbox contents (scraping payload reported)
- Facebook Business Manager advertising account data (collection payload reported)
- YouTube channel information (collection payload reported)
- Affected Records
- Approximately 7,000 users had the extension; the number whose data was actually accessed or stolen is not disclosed.
- Operational Impact
- QuickLens v5.8 requested additional permissions, removed browser security headers, and injected scripts on visited pages. It displayed fake Google Update prompts leading to ClickFix, delivered malware, and attempted to collect credentials and wallet data. Google removed the extension, and Chrome automatically disabled it.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]extensionanalyticspro[.]top | Command-and-control domain polled by the compromised extension for instructions and malicious JavaScript payloads. |
| DOMAIN | google-update[.]icu | Payload host contacted by injected JavaScript to obtain content displaying a fake Google Update prompt and ClickFix instructions. |
MITRE ATT&CK
T1059.001 · PowerShellThe downloaded executable launched hidden PowerShell commands to retrieve and execute a second-stage response.T1059.007 · JavaScriptThe extension received and executed malicious JavaScript payloads on page loads.T1204.004 · Malicious Copy and PasteThe fake update prompt instructed users to copy and run code themselves, matching the reported ClickFix activity.
Malware
Atomic macOS Stealer (AMOS)Google Update prompts, delivered executables and infostealers (including components named Katzilla and AMOS), and attempted to exfiltrate credentials and cryptocurrency wallet seed phrases from thousands of users.KatzillaClickFix fake Google Update prompts, delivered executables and infostealers (including components named Katzilla and AMOS), and attempted to exfiltrate credentials and cryptocurrency wallet seed phrases from thousands
Vendors
Products
Google ChromeA Chrome extension called QuickLens was hijacked after a change of ownership and a malicious update (v5.8) stripped site security headers, gained elevated permissions, and injected scripts from a command-and-controlMetaMask#QuickLensPhantomThe campaign targeted cryptocurrency wallets (e.g., MetaMask, Phantom) and other credentials; Google removed QuickLens and affected users should uninstall it, scan devices, reset passwords, and move crypto funds.QuickLensA Chrome extension called QuickLens was hijacked after a change of ownership and a malicious update (v5.8) stripped site security headers, gained elevated permissions, and injected scripts from a command-and-control