Malicious Chrome Extensions Used for Data Theft via Ownership Transfers and Impersonation

Multiple malicious Chrome/Chromium extensions were identified abusing the Chrome Web Store to steal data from users and enterprises. Two previously legitimate extensions—QuickLens (kdenlnncndfnhkognokgfpabgkgehodd) and ShotBird (gengfhhkjekmlejbhmmopegofnoifnjp)—reportedly turned malicious after ownership transfers, enabling downstream compromise through injected code and data harvesting. In the QuickLens case, researchers reported the malicious update preserved expected functionality while adding capabilities to strip security headers (e.g., X-Frame-Options) and facilitate script injection that can bypass Content Security Policy (CSP) protections, expanding the attacker’s ability to make cross-domain requests and collect sensitive information.

Separately, Microsoft reported a campaign of counterfeit “AI assistant” browser extensions distributed via the Chrome Web Store (and therefore also impacting Microsoft Edge environments that allow Chrome extensions), which allegedly affected 20,000+ enterprise tenants and amassed roughly 900,000 installs. These extensions impersonated legitimate AI productivity tools and harvested ChatGPT/DeepSeek conversation histories, visited URLs, and browsing telemetry, staging data for exfiltration to attacker-controlled infrastructure. Another Chrome Web Store threat involved a fake imToken-branded extension (“lmΤoken Chromophore”) that masqueraded as a benign tool but redirected victims to phishing infrastructure to steal seed phrases and private keys, using tactics like hardcoded remote configuration (via JSONKeeper) and decoy navigation to the legitimate token.im site after credential capture.