QuickLens

Compromised Chromium Extensions Push Malware Through Fake Critical Update Alerts

Users of Chromium-based browsers including Chrome, Brave, and Opera have encountered persistent pop-up windows demanding immediate browser updates. These alerts originate from compromised extensions that dynamically load malicious VBS scripts or EXE files instead of delivering legitimate updates. The deceptive messages appear during normal browsing and instruct users to download and manually execute suspicious files. Earlier incidents were traced to the QuickLens extension, while current reports implicate Enable Right Click & Copy Smart Unlock + OCR and similar utilities still available in the Chrome Web Store. Attackers achieve persistence by purchasing popular extensions or hijacking developer accounts to push malicious updates. Full system scans often fail to detect the threat because the browser itself remains clean until the user triggers the payload. Security experts recommend verifying updates exclusively through the browser's built-in menu rather than clicking any on-screen prompts.