A sophisticated scam is leveraging a seemingly trustworthy Chrome extension to trick users into downloading malicious files disguised as critical browser updates. The scam, linked to the extension formerly known as Enable Right Click & Copy - Smart Unlock + OCR, highlights the evolving threat landscape where legitimate software can be weaponized after changing ownership.

Security researchers at Socket reported that the extension, which had approximately 70,000 users, was acquired by a threat actor and updated with malicious functionality. This update included the capability to display fake browser update warnings. Google confirmed its investigation into the extension and stated that action has been taken to protect users, leading to its delisting from the Chrome Web Store on August 14.

How the Scam Operates

The deceptive pop-ups can appear on otherwise normal websites, urging users to click on a warning like "Critical Update Required" or "Update Available." The prompt then directs users to download unfamiliar files, often .vbs scripts or .exe files, instead of updating through Chrome's built-in mechanism. Google Chrome typically updates automatically in the background, and users can manually check for updates via the browser's help menu.

This tactic is particularly concerning because it exploits the trust users place in browser extensions they may have installed months prior. The acquired extension was reportedly removed from the Chrome Web Store after being flagged, but the underlying threat pattern affects multiple extensions.

Evolving Threats from Compromised Extensions

Socket's research indicates the compromised extension was part of a broader campaign involving 19 Chrome and Edge extensions. These extensions were capable of delivering malicious payloads, including stealing credentials, draining cryptocurrency wallets, injecting phishing pages, and perpetuating fake browser update lures. Researchers noted that some of these extensions initially began as legitimate tools before being acquired and repurposed by malicious actors.

This pattern has been observed before. Earlier in the year, the "QuickLens - Search Screen with Google Lens" extension also changed ownership, leading to malicious updates that injected code and displayed fake prompts. Google has since removed such extensions from its store.

Red Flags and Protection Measures

Users encountering urgent update warnings from webpages should be suspicious. Chrome's official update process is managed through the browser itself. A webpage prompting a download for an update is a significant red flag. Users should instead navigate directly to Chrome's settings to check for updates.

Beyond fake update prompts, the compromised extensions have been linked to broader malicious activities such as credential theft and cryptocurrency wallet draining. Even if a full antivirus scan detects no immediate threats, the extension itself may be injecting deceptive content within the browser, or a downloaded file could pose a separate risk if executed.

Staying Safe

To mitigate these risks, users are advised to adopt several security practices:

  • Never update Chrome from a webpage pop-up. Instead, manually check for updates within the browser's settings.
  • Utilize strong, real-time antivirus software and ensure it is kept up-to-date.
  • Regularly review browser extensions. Remove any extensions that are no longer used or recognized, paying attention to their permissions.
  • Read the newest reviews before installing an extension. Do not rely solely on the overall star rating, as recent negative reviews can signal emerging problems.
  • Enable Chrome's Enhanced Protection for additional security against dangerous websites and downloads.
  • Delete unexpected downloaded files without opening them. If a file was downloaded from a suspicious prompt, do not execute it and run a full system scan afterward.

If a suspicious extension has been identified and removed, users should restart their browser, perform a full security scan, and change passwords for sensitive accounts accessed on the affected device. If fake update warnings persist after removing an extension, users may need to disable other extensions one by one or investigate potential malware elsewhere on their computer.