QuickLens Chrome extension steals crypto, shows ClickFix attack

A malicious update to the QuickLens Chrome extension (v5.8) compromised thousands of users by removing security headers and executing remote JavaScript from a command-and-control server, delivering fake Google Update/ClickFix prompts that led to malware downloads and PowerShell-based second stages, and deploying agents to steal cryptocurrency wallets, login credentials, and account data; Google removed and disabled the extension and users are advised to remove it, scan systems, reset credentials, and move crypto funds.