QuickLens and ShotBird Chrome Extension Hijack: Windows Fake Update Risks and Cleanup Steps

What the author did​

Yash Patel's story is a personal one. He used QuickLens and ShotBird every day, then learned that both had changed hands and been weaponized. Both came from the same original developer and reportedly turned malicious after being sold. Rather than hunt for similar extensions, he used Claude Code and detailed prompts to build his own.

• LensSnap: By his description, it lets him select part of a page, image or video frame and search it with Google Lens. It can also send captures to shopping searches, copy them or save them as PNG files, and it keeps a short history.
• SnapNest: This is a screenshot tool for a region, a full page or a single element. It has an editor with gradients, backgrounds, annotations, blur tools and several export formats.
• Stated privacy design: Both have restricted permissions, no analytics and no remote code. He says SnapNest processes captures locally and makes no network requests. He says both extensions limit access to the active tab when he invokes them.

I found no public listing, repository or audit for his LensSnap or SnapNest, so these properties are unverified. A Chrome Web Store item also called "SnapNest" exists, but it's an unrelated product that uploads screenshots to an online account. Don't confuse the two.

What happened to the originals​

The incident the author reacted to is real and well documented.

• QuickLens: Annex Security researcher John Tuckner found that QuickLens was listed for sale on ExtensionHub on October 11, 2025. On February 1, 2026, the owner on the Chrome Web Store listing changed to a new address. The malicious update landed on February 17, 2026. It kept the original functionality but stripped security headers such as X-Frame-Options, which let injected scripts make cross-domain requests and bypass Content Security Policy protections.
• ShotBird: Researcher monxresearch-sec reported that ShotBird was featured in January 2025 and later transferred to a new contact address. The researcher's write-up describes remote JavaScript tasks, fake Chrome update lures and capture of form input.
• Scale: Jamaica's national CIRT advisory puts the user counts at roughly 7,000 for QuickLens and 800 for ShotBird. It rates the threat "Critical."

BleepingComputer, citing Annex, reported that QuickLens version 5.8 asked for new permissions, including declarativeNetRequestWithHostAccess and webRequest. It also reported that the extension polled an external server every five minutes for JavaScript, which was stored locally and executed on each page load.

Why Windows users should care​

This wasn't only a browser problem. On Windows, the fake update lures could push users to run a file or paste a command.

• The fake installer: The ShotBird researcher describes a googleupdate.exe wrapper. It bundled a genuine Google-signed Chrome installer next to a malicious MSI stager, which fetched PowerShell content from a remote domain. BleepingComputer saw the same file name for QuickLens.
• Evidence on the host: The researcher says PowerShell Script Block Logging (Event ID 4104) on a Windows machine captured the stager. It also allowed reconstruction of a larger second-stage script. The researcher says that script targeted Credential Manager and Chromium login data.
• A defensive takeaway: If you manage Windows endpoints, Script Block Logging is the kind of telemetry that made this analysis possible.

What to do if you had either extension​

BleepingComputer's advice to QuickLens users is to make sure the extension is fully removed, scan the device for malware and reset passwords for credentials stored in the browser. It adds that fake Chrome update prompts were designed to trick users into installing malware, so never run commands a website tells you to. The Jamaica CIRT advisory adds guidance for administrators:

1. Remove the identified extensions and treat any installed copies as potentially compromised.
2. Audit installed extensions and remove the unnecessary or unverified ones.
3. Restrict installs with Chrome Enterprise policies or allow-listing.
4. Use EDR to watch for malicious PowerShell and unusual browser-spawned processes.
5. Review permissions and updates for abnormal changes after ownership transfers.
6. Require password resets for sensitive accounts if the extensions were present.

Is building your own the answer?​

It's a reasonable response, with caveats. A private extension has no new owner who can push a hostile update, and it can request narrow permissions. That removes the specific risk in this story.

But AI-generated code isn't automatically safe. Anthropic's Claude Code documentation describes a permission system and stresses reviewing proposed changes before approving them. It also advises using VMs when working with untrusted content. Local processing and minimal permissions reduce exposure, but they don't prove an extension is secure.

For most people, the more practical lesson is to treat extensions as software that can change hands. Check permissions after updates. Remove extensions you no longer use. In a managed environment, control what can be installed at all.

Bottom line​

The ownership-transfer attack on QuickLens and ShotBird is corroborated by several sources. The author's DIY replacement is a sensible, if unverified, answer to it. The wider lesson is that the extension you trusted last year may now be run by someone else.