The QuickLens Chrome extension (version 5.8) was recently flagged for transforming from a legitimate tool into a malicious infostealer. According to reports from BleepingComputer, the extension was compromised to drain cryptocurrency wallets and execute “ClickFix” social engineering attacks.

The Attack Mechanism

• Wallet Draining: The extension targeted popular wallets like MetaMask, Phantom, and Coinbase Wallet, attempting to exfiltrate seed phrases and private keys.
• ClickFix Social Engineering: It displayed fake “Google Chrome Update” overlays. These prompts tricked users into copying a malicious command to their clipboard and executing it via the Windows Run (Win+R) dialog, effectively bypassing browser sandbox protections.
• Information Theft: Beyond crypto, it was designed to scrape Gmail messages and Facebook Business Manager data to compromise high-value accounts.

Immediate Recovery Steps

1. Uninstall: Verify the extension is removed by visiting chrome://extensions/ in your browser.
2. Migrate Crypto: If you interacted with the extension, assume your seed phrase is compromised. Create a new wallet on a clean device and transfer your assets immediately.
3. Run a Malware Scan: Use the Malwarebytes Free Scanner or Bitdefender to check for persistent scripts or “Atomic Stealer” payloads left on your system.
4. Rotate Credentials: Change passwords for your primary email and any financial accounts accessed while the extension was active.