Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft

Two Chrome extensions (QuickLens and ShotBird) were weaponized after ownership transfers to push remote JavaScript from a C2, bypass CSP and security headers, and execute runtime payloads that enable in-browser data harvesting and, in the case of ShotBird, a fake-update chain that leads to host-level execution (downloaded binary and credential capture); the report also highlights multiple other malicious/abusive Chrome extensions and large-scale redirect/hijack campaigns and advises immediate removal and auditing of browser extensions.