QuickLens Chrome extension steals crypto, shows ClickFix attack
2026-03-04T20:08:24Z•a2e7906fe830780832028642fc19bd884ccec42d672a32c83da8f8e726bbe6ed
CVE-2025-0282API-keysAPT37ChromeClickFixEuropolGoogle-GeminiIvantiJuniper-PTXRCERESURGETrend-Micro-Apex-Oneair-gapped-networksbrowser-extensioncrypto-theftdata-breachlaw-enforcementmalwareremovable-mediaseed-phrase-exposurethird-party-patching
What happened
Multiple high-impact security incidents and advisories reported: a maliciously altered Chrome extension (“QuickLens”) was removed for stealing crypto and using ClickFix-style social engineering; South Korea’s National Tax Service accidentally published a seized wallet mnemonic, enabling theft of ~6.4 billion won (~$4.8M); CISA warns the RESURGE implant (used in zero-day attacks) can remain dormant on Ivanti Connect Secure devices (linked to CVE-2025-0282); a critical Juniper PTX Junos OS Evolved vulnerability enabling unauthenticated full router takeover was disclosed; Trend Micro patched two
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- a2e7906fe830780832028642fc19bd884ccec42d672a32c83da8f8e726bbe6ed
- Enrichment time
- 2026-03-04T20:08:24Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.