ClickFix Attack Archives

After being hacked to distribute malware and try to steal cryptocurrency from thousands of users, the Chrome extension "QuickLens - Search Screen with Google Lens" was taken down from the Chrome Web Store. Originally released as a Chrome addon, QuickLens enables users to conduct Google Lens searches right within their browser. At one time, Google awarded the extension a prominent badge after it reached about 7,000 users. On February 17, 2026, however, a new version 5.8 was made available, which included malicious scripts that gave users of the extension the ability to steal information and launch ClickFix attacks. After the plugin was put up for sale on ExtensionHub a marketplace where developers sell browser extensions read more about QuickLens Chrome extension steals crypto, sh...

Microsoft revealed information about a new iteration of the ClickFix social engineering technique, in which the attackers fool gullible victims into executing commands that perform a DNS lookup in order to obtain the subsequent payload. The attack specifically uses the "nslookup" command, which stands for "nameserver lookup," to do a custom DNS lookup that is initiated via the Windows Run dialog. ClickFix is a growingly common technique that is typically distributed through drive-by download schemes, phishing, or malvertising. It frequently directs victims to fraudulent landing pages that display phony CAPTCHA verification or instructions to fix a computer issue that doesn't exist by executing a command via the macOS Terminal application or the Windows Run dialog. Over the past t...

Tag: ClickFix Attack

QuickLens Chrome extension steals crypto, shows ClickFix attack

Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging