Beware: Fake Chrome Update Scam Targets Millions

A recent Chrome extension called Enable Right Click & Copy - Smart Unlock + OCR was originally developed as a legitimate tool for restoring right-click and copying features on websites that block them. However, security researchers at Socket discovered that the extension was later acquired by a threat actor and updated with malicious functionality.

The extension had around 70,000 users when the malicious functionality appeared, although researchers caution that this does not mean every user received the malicious version. The extension was delisted from the Chrome Web Store on Aug. 14 after being flagged as potentially malicious.

Users may see language such as 'Critical Update Required' or 'Update available' while visiting an otherwise normal website, prompting them to download something before continuing to browse. However, Chrome normally handles its updates through the browser itself, and users should be cautious of unfamiliar .vbs script or .exe files that claim to update Chrome.

Google recommends going directly to the program or its official website for updates, rather than relying on suspicious pop-ups asking users to install them. The company's Safe Browsing system checks installed extensions and downloads against known threats, but newly emerging threats can create a window where users encounter trouble before defenses catch up.