A recent scam involving a popular Chrome extension has raised concerns about fake update warnings that can compromise users’ computers.
A Chrome extension with approximately 70,000 users and a 4.7-star rating has been linked to a fake update scam that injects misleading warnings into users’ browsers. This alarming development occurred after a threat actor acquired and weaponized the extension, originally designed to restore right-click and copying features on websites that block them.
According to security researchers at Socket, the extension, known as Enable Right Click & Copy – Smart Unlock + OCR, began displaying urgent messages claiming that a “Critical Update” was required to continue browsing. These messages can be convincing, leading users to believe that clicking on the “Update” button is the safest option. However, this is precisely what makes the scam so dangerous.
The extension was delisted from the Chrome Web Store on August 14 after being flagged as potentially malicious. While it had a substantial user base at the time, researchers caution that not every user was affected by the malicious version. This incident serves as a reminder that software you trust can change unexpectedly after an update.
The warning messages can appear while visiting otherwise legitimate websites, often using phrases like “Critical Update Required” or “Update available.” Users are then prompted to download a file before they can continue browsing. In reality, Chrome typically handles updates automatically in the background, and users can manually check for updates by navigating to More > Help > About Google Chrome.
Any webpage requesting the download of a .vbs script or an unfamiliar .exe file should raise immediate suspicion. Google explicitly advises users to avoid suspicious pop-ups that ask for software installations. Instead, users should go directly to the official website or the program itself for updates.
One of the most concerning aspects of this scam is that users may have installed the extension when it had a strong reputation and positive reviews. Over time, however, the extension can be updated with malicious functionality without users’ knowledge. Google confirmed to CyberGuy that they investigated the Enable Right Click & Copy extension and took action to protect users.
Further research from Socket, published on August 27, indicates that the threat extends beyond fake update warnings. The researchers linked the extension to a broader campaign involving 19 Chrome and Edge extensions that can deliver malicious payloads, including credential theft, cryptocurrency wallet draining, and injected phishing pages. Many of these extensions began as legitimate products before being weaponized by the threat actor.
This pattern of behavior is not new. Earlier this year, researchers discovered that another extension, QuickLens – Search Screen with Google Lens, changed ownership before a malicious update was introduced. This extension had previously earned a Featured badge from Google but was later found to have malicious capabilities, including injecting code and displaying fake update prompts.
CyberGuy has also reported on trusted browser extensions that later turned into spyware, affecting millions of users. This history highlights the importance of being cautious with browser extensions, as a high rating does not guarantee future safety.
Interestingly, the Enable Right Click & Copy extension maintained an average rating of 4.7 stars even as reports of fake update warnings emerged. This discrepancy can occur because earlier positive ratings remain part of the overall score, while recent reviews may begin to reflect users’ negative experiences.
Before installing any extension, users should look beyond the overall star rating and pay attention to recent reviews. CyberGuy previously covered another scam involving a fake ad blocker that caused computer issues and prompted users to execute dangerous commands to resolve them.
One Reddit user who encountered the recent fake update warnings discovered that a full scan found nothing. However, they traced the pop-ups back to the Right Click extension. A clean scan should not convince users that a suspicious browser warning is safe, as the extension itself may be responsible for the alerts.
Google’s Safe Browsing system checks installed extensions and downloads against known threats, and Chrome can disable extensions identified as malicious. However, newly emerging threats can create a window of vulnerability before defenses catch up, making user awareness crucial.
Users of Chromium-based browsers, including Brave and Opera, have reported similar fake Chrome update prompts. These warnings are often linked to suspicious browser extensions rather than legitimate updates. Therefore, if a browser claims that Google Chrome needs an update, users should be cautious and not follow the prompt.
To check for updates manually, users can open Chrome, click the three-dot menu, and navigate to Help > About Google Chrome. This method ensures that users are aware of their current version and can avoid falling victim to fake alerts.
It is also essential to review installed extensions regularly. Google allows users to disable or remove extensions and check their permissions. If you have the Enable Right Click & Copy extension installed, it is advisable to remove it, even if you have not interacted with any suspicious downloads.
After removing the extension, users should restart Chrome, run a full security scan, and change passwords for sensitive accounts accessed while the extension was installed from a trusted device. For those with multiple unfamiliar extensions, it is wise to disable them and only re-enable the ones you recognize and need.
To minimize the risk of falling for convincing pop-ups, users should develop smart browsing habits. If a webpage prompts you to download an update, close the warning and check for updates directly through Chrome’s settings. Google also warns against websites claiming that software needs to be downloaded due to a virus.
Strong antivirus protection is another essential layer of defense. Users should seek antivirus software that offers real-time protection and keep it updated to guard against new threats. If you accidentally clicked a fake update or ran a suspicious file, perform a full system scan and follow the antivirus program’s instructions if malware is detected.
Regularly reviewing installed extensions is crucial. Users should pay particular attention to those that can read and change data on all websites, as these pose a higher risk. If an extension suddenly requests broader permissions or its purpose is unclear, it is best to remove it.
In conclusion, users must remain vigilant when it comes to browser extensions. A high star rating or a large user base does not guarantee safety, and malicious updates can occur without warning. Always verify updates through official channels and maintain a cautious approach to browser extensions to protect your computer from potential threats. For more information on identifying warning signs, CyberGuy offers a comprehensive guide on browser hijacking.
For further assistance, visit CyberGuy.com for tips on protecting your online security.