Malware-Tainted QuickLens Chrome Extension Steals Cryptocurrency Data

QuickLens, a screen color-picking and search extension once featured by the Google Chrome Web Store, had about 7,000 users. Browser extensions can read webpage content and login information, meaning a compromised software-update supply chain can directly threaten account credentials and cryptocurrency wallet assets.

Security researchers found that QuickLens version 5.8 had been injected with malicious JavaScript. The hackers also impersonated venture capitalists and used the ClickFix technique to trick victims into executing commands that stole credentials and cryptocurrency wallet data. Google has removed the extension from the Chrome Web Store and automatically disabled it for about 7,000 users.