{"investigation":{"slug":"quicklens-chrome-extension-supply-chain-attack","entity_name":"QuickLens Chrome Extension Supply Chain Attack","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.85,"status":"draft","content_type":"investigation","summary":"QuickLens (\"Search Screen with Google Lens\"), a Chrome extension with roughly 7,000 users, was allegedly acquired via an ownership transfer on February 1, 2026 and subsequently weaponized in a malicious update (version 5.8) released February 17, 2026. Security researchers documented crypto-wallet-draining code, ClickFix-style social-engineering malware delivery, and theft of Gmail, Facebook Business Manager, and YouTube data before Google removed the extension from the Chrome Web Store. A later report (August 2026) ties QuickLens to a broader 19-extension campaign of purchased-and-weaponized browser add-ons.","sections":[{"content":"QuickLens, listed on the Chrome Web Store as \"Search Screen with Google Lens\" (extension ID kdenlnncndfnhkognokgfpabgkgehodd), was a legitimately published tool that let users run Google Lens searches from the browser. It grew to approximately 7,000 users and reportedly received a Google \"featured\" badge. According to security research firm SecureAnnex (referred to in some coverage simply as \"Annex\"), the extension was listed for sale on ExtensionHub, a marketplace for browser-extension developers, and ownership was transferred to an account using the email support@doodlebuggle.top under the name \"LLC Quick Lens\" on February 1, 2026. The new owner reportedly published an updated privacy policy hosted on what researchers described as a barely functional domain. This pattern — acquiring an established extension with a real user base and pre-existing store trust signals, then converting it to malware — is characteristic of a browser-extension supply chain attack.","heading":"Extension Identity and Ownership Transfer","sources":[{"url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","name":"BleepingComputer: \"QuickLens Chrome extension steals crypto, shows ClickFix attack\"","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/03/chrome-extension-turns-malicious-after.html","name":"The Hacker News: \"Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft\"","type":"news_article","credibility":2},{"url":"https://app.secureannex.com/extensions/search/kdenlnncndfnhkognokgfpabgkgehodd?platform=chrome","name":"SecureAnnex extension analysis page for QuickLens","type":"research","credibility":2}],"severity":"high"},{"content":"Coverage from BleepingComputer, SC Media, and third-party risk firm Rescana reports that version 5.8 of QuickLens, released February 17, 2026, requested new browser permissions (including declarativeNetRequestWithHostAccess and webRequest) and introduced malicious functionality while retaining the extension's original Google Lens feature to avoid suspicion. The update allegedly stripped security headers such as X-Frame-Options from HTTP responses and removed Content Security Policy protections, enabling injected scripts to make arbitrary cross-domain requests. The extension is alleged to have deployed \"ClickFix\" attacks — fake prompts (reported as impersonating Google Update dialogs) that socially engineer victims into running attacker-supplied commands, which in turn delivered malware. Reported payloads include a custom tool referred to as \"Katzilla\" (used for PowerShell-based command execution) and an unconfirmed reference to AMOS (Atomic Stealer), a known macOS-targeting infostealer. The extension was reported to scan for and target at least eleven cryptocurrency wallets: MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Solflare, Backpack, Brave Wallet, Exodus, Binance Chain Wallet, WalletConnect, and Argon, attempting to capture wallet activity and seed phrases.","heading":"Malicious Version 5.8: ClickFix Attack and Wallet Draining","sources":[{"url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","name":"BleepingComputer: \"QuickLens Chrome extension steals crypto, shows ClickFix attack\"","type":"news_article","credibility":2},{"url":"https://www.scworld.com/brief/malicious-chrome-extension-quicklens-removed-after-stealing-crypto-and-spreading-malware","name":"SC Media / SC World: \"Chrome extension 'QuickLens' removed after stealing crypto and spreading malware\"","type":"news_article","credibility":2},{"url":"https://www.rescana.com/post/quicklens-chrome-extension-supply-chain-attack-cryptocurrency-theft-and-clickfix-malware-campaign-a","name":"Rescana: \"QuickLens Chrome Extension Supply Chain Attack: Cryptocurrency Theft and ClickFix Malware Campaign Analysis\"","type":"research","credibility":2}],"severity":"critical"},{"content":"Beyond wallet-targeting behavior, reporting alleges that QuickLens's malicious update scraped the contents of victims' Gmail inboxes, extracted Facebook Business Manager advertising account data, and collected YouTube channel information, in addition to harvesting browser-stored login credentials and payment form data. This broadens the alleged impact beyond crypto users to a wider set of Chrome users whose Google, Meta, or YouTube accounts could be exposed.","heading":"Non-Crypto Data Theft: Gmail, Facebook Ads, YouTube","sources":[{"url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","name":"BleepingComputer: \"QuickLens Chrome extension steals crypto, shows ClickFix attack\"","type":"news_article","credibility":2},{"url":"https://www.rescana.com/post/quicklens-chrome-extension-supply-chain-attack-cryptocurrency-theft-and-clickfix-malware-campaign-a","name":"Rescana: \"QuickLens Chrome Extension Supply Chain Attack: Cryptocurrency Theft and ClickFix Malware Campaign Analysis\"","type":"research","credibility":2}],"severity":"high"},{"content":"Rescana's analysis lists alleged command-and-control infrastructure associated with the campaign, including a primary C2 domain (api.extensionanalyticspro[.]top), a secondary payload server (google-update[.]icu), and a malware download path (drivers[.]solutions/META-INF/xuoa.sys). These indicators of compromise come from a single Tier 2 research source and have not been independently corroborated in the other outlets reviewed, so they are presented here with lower confidence than the core narrative of the attack.","heading":"Command-and-Control Infrastructure","sources":[{"url":"https://www.rescana.com/post/quicklens-chrome-extension-supply-chain-attack-cryptocurrency-theft-and-clickfix-malware-campaign-a","name":"Rescana: \"QuickLens Chrome Extension Supply Chain Attack: Cryptocurrency Theft and ClickFix Malware Campaign Analysis\"","type":"research","credibility":2}],"severity":"medium"},{"content":"A later report from security research firm Socket, published in August 2026, identified QuickLens as one of at least five extensions among a tracked set of 19 Chrome and Edge extensions (a campaign researchers labeled \"Superior\") that were purchased from their original developers and subsequently weaponized with wallet-draining and data-harvesting code. According to The Hacker News's coverage of Socket's findings, this broader campaign has been active since February 2024 and involves 16 distinct malicious modules targeting wallet draining, seed-phrase harvesting, credential theft, and browser history extraction. Socket's report describes QuickLens as retaining the ability to establish a persistent WebSocket connection to a command-and-control server and to strip Content Security Policy headers to facilitate script injection. QuickLens had reportedly already been flagged earlier in 2026 by both SecureAnnex and a researcher/entity referred to as \"monxresearch-sec\" prior to the Socket report.","heading":"Broader Campaign: \"Superior\" — 19 Extensions Purchased and Weaponized","sources":[{"url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html","name":"The Hacker News: \"19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code\"","type":"news_article","credibility":2},{"url":"https://dailyhodl.com/2026/09/01/malware-discovered-in-19-google-chrome-browser-extensions-as-hackers-push-to-drain-crypto-and-harvest-data/","name":"The Daily Hodl: \"Malware Discovered In 19 Google Chrome Browser Extensions As Hackers Push To Drain Crypto and Harvest Data\"","type":"news_article","credibility":2}],"severity":"high"},{"content":"Multiple outlets report that Google removed QuickLens from the Chrome Web Store following disclosure of the malicious update, and that the extension was automatically disabled for users who had it installed. Security researchers and outlets advised affected users to confirm the extension was fully removed, scan devices for malware, reset browser-stored passwords, and — for users of the targeted cryptocurrency wallets — migrate funds to a newly created wallet as a precaution, on the assumption that seed phrases or private keys may have been exposed.","heading":"Google's Response and Remediation Guidance","sources":[{"url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","name":"BleepingComputer: \"QuickLens Chrome extension steals crypto, shows ClickFix attack\"","type":"news_article","credibility":2},{"url":"https://www.techrepublic.com/article/news-compromised-chrome-extension-malware-crypto-theft/","name":"TechRepublic: \"Chrome Extension Hijacked to Deliver Malware, Steal Crypto Wallets\"","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-02-01","event":"Ownership of the QuickLens Chrome extension allegedly transferred to an account using the email support@doodlebuggle.top under the name \"LLC Quick Lens\", after being listed for sale on the ExtensionHub marketplace.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","date_evidence":"the owner changed to support@doodlebuggle.top under \"LLC Quick Lens\" on February 1, 2026"},{"date":"2026-02-17","event":"Version 5.8 of QuickLens was released, allegedly containing malicious scripts enabling ClickFix-style malware delivery, wallet-draining code, and header-stripping functionality.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","date_evidence":"On February 17, 2026, version 5.8 was released that contained malicious scripts introducing ClickFix attacks and info-stealing functionality"},{"date":"2026-02","event":"BleepingComputer published its report on the QuickLens compromise, describing crypto wallet targeting, ClickFix attacks, and data theft from Gmail, Facebook, and YouTube.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","date_original":"2026-02-28"},{"date":"2026-03","event":"Forbes, The Hacker News, TechRepublic, SC Media, and other outlets published follow-up coverage of the QuickLens compromise, and the extension was removed from the Chrome Web Store.","source":"Forbes","source_url":"https://www.forbes.com/sites/daveywinder/2026/03/01/search-screen-with-google-lens-tool-compromised-to-steal-credentials/"},{"date":"2026-08-27","event":"Security research firm Socket published findings on a broader campaign (\"Superior\") of 19 Chrome and Edge extensions, including QuickLens, purchased from original developers and weaponized with wallet-draining code.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html","date_evidence":"discovered by security research firm Socket, which published its findings on August 27"}],"sources_used":[{"url":"https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","name":"BleepingComputer: \"QuickLens Chrome extension steals crypto, shows ClickFix attack\"","type":"news_article","archive_url":"http://web.archive.org/web/20260830200917/https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-steals-crypto-shows-clickfix-attack/","credibility":2,"archive_timestamp":"2026-08-30T20:09:17+00:00"},{"url":"https://www.scworld.com/brief/malicious-chrome-extension-quicklens-removed-after-stealing-crypto-and-spreading-malware","name":"SC Media / SC World: \"Chrome extension 'QuickLens' removed after stealing crypto and spreading malware\"","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.techrepublic.com/article/news-compromised-chrome-extension-malware-crypto-theft/","name":"TechRepublic: \"Chrome Extension Hijacked to Deliver Malware, Steal Crypto Wallets\"","type":"news_article","archive_url":"http://web.archive.org/web/20260308201353/https://www.techrepublic.com/article/news-compromised-chrome-extension-malware-crypto-theft/","credibility":2,"archive_timestamp":"2026-03-08T20:13:53+00:00"},{"url":"https://www.rescana.com/post/quicklens-chrome-extension-supply-chain-attack-cryptocurrency-theft-and-clickfix-malware-campaign-a","name":"Rescana: \"QuickLens Chrome Extension Supply Chain Attack: Cryptocurrency Theft and ClickFix Malware Campaign Analysis\"","type":"research","archive_url":"http://web.archive.org/web/20260902032042/https://www.rescana.com/post/quicklens-chrome-extension-supply-chain-attack-cryptocurrency-theft-and-clickfix-malware-campaign-a","credibility":2,"archive_timestamp":"2026-09-02T03:20:42+00:00"},{"url":"https://thehackernews.com/2026/03/chrome-extension-turns-malicious-after.html","name":"The Hacker News: \"Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft\"","type":"news_article","archive_url":"http://web.archive.org/web/20260910091350/https://thehackernews.com/2026/03/chrome-extension-turns-malicious-after.html","credibility":2,"archive_timestamp":"2026-09-10T09:13:50+00:00"},{"url":"https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html","name":"The Hacker News: \"19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code\"","type":"news_article","archive_url":"http://web.archive.org/web/20260911201237/https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html","credibility":2,"archive_timestamp":"2026-09-11T20:12:37+00:00"},{"url":"https://dailyhodl.com/2026/09/01/malware-discovered-in-19-google-chrome-browser-extensions-as-hackers-push-to-drain-crypto-and-harvest-data/","name":"The Daily Hodl: \"Malware Discovered In 19 Google Chrome Browser Extensions As Hackers Push To Drain Crypto and Harvest Data\"","type":"news_article","archive_url":"http://web.archive.org/web/20260903022551/https://dailyhodl.com/2026/09/01/malware-discovered-in-19-google-chrome-browser-extensions-as-hackers-push-to-drain-crypto-and-harvest-data/","credibility":2,"archive_timestamp":"2026-09-03T02:25:51+00:00"},{"url":"https://www.forbes.com/sites/daveywinder/2026/03/01/search-screen-with-google-lens-tool-compromised-to-steal-credentials/","name":"Forbes: \"Google Lens Chrome Browser Tool Compromised To Steal Credentials\"","type":"news_article","archive_url":"http://web.archive.org/web/20260830171343/https://www.forbes.com/sites/daveywinder/2026/03/01/search-screen-with-google-lens-tool-compromised-to-steal-credentials/","credibility":1,"archive_timestamp":"2026-08-30T17:13:43+00:00"},{"url":"https://app.secureannex.com/extensions/search/kdenlnncndfnhkognokgfpabgkgehodd?platform=chrome","name":"SecureAnnex extension analysis page for QuickLens","type":"research","archive_url":"http://web.archive.org/web/20260404194503/https://app.secureannex.com/extensions/search/kdenlnncndfnhkognokgfpabgkgehodd?platform=chrome","credibility":2,"archive_timestamp":"2026-04-04T19:45:03+00:00"},{"url":"https://www.pcrisk.com/removal-guides/35025-quicklens-search-screen-with-google-lens-malicious-extension","name":"PCRisk removal guide: \"QuickLens - Search Screen with Google Lens Malicious Extension\"","type":"community_report","archive_url":"http://web.archive.org/web/20260421195049/https://www.pcrisk.com/removal-guides/35025-quicklens-search-screen-with-google-lens-malicious-extension","credibility":3,"archive_timestamp":"2026-04-21T19:50:49+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-19T12:09:35.903739+00:00","updated_at":"2026-09-19T14:10:18.293852+00:00"}}