If you've recently seen a pop-up window in your browser asking you to install a critical Chrome update, ignore it. It's a malware campaign circulating that exploits user trust to sneak dangerous files onto their computers. The alert, which perfectly mimics the style of legitimate notifications, has been reported on forums like Reddit and has already affected users of Chrome, Brave, and Opera.
The deception is simple but effective: when the update button is clicked, instead of the normal process starting, an executable file with the .exe or .vbs extension is downloaded . If the user opens it, the malware can take control of the computer and use it to mine cryptocurrencies, among other things. Most worryingly, some antivirus tools, such as Malwarebytes, fail to detect the threat, while Windows Defender has managed to block some downloads.
This is how the fake update scam works
The messages pop up suddenly while you're browsing and use alarmist language, such as "Critical update required" or "An update is available." Some even warn that the browser will stop working if the update isn't installed immediately. The intention is to get you to act impulsively and click the button. However, legitimate Chrome updates are never downloaded from a pop-up window . They are always managed from within the browser itself, via the three-dot menu and the option 'Help' > 'About Google Chrome'.
Once the user clicks the button, the system downloads a .vbs script or an .exe file from an external source. The infection is complete when the user opens that file and authorizes its execution. From there, the malware can use the computer's resources to mine cryptocurrency without the user's knowledge. Typical symptoms include decreased performance, increased power consumption, and constantly running fans.
The Enable Right Click & Copy extension is under suspicion.
Reports gathered on Reddit point to a specific extension as the likely culprit: Enable Right Click & Copy Smart Unlock + OCR. This tool, designed to allow copying protected text and recognizing words in images, has been mentioned in several threads. It's unclear whether the original creators are behind the attack or if the extension was compromised by a third party. In fact, Google hasn't removed the extension from the Chrome Web Store , adding to the confusion.
What does seem confirmed is that the extension can act as an intermediary , connecting to external servers to load the fake pop-ups. This would explain why the problem isn't limited to Chrome, but also affects Chromium-based browsers like Brave and Opera. In some cases, the notification prompts you to update Chrome while another browser is being used, a contradiction that reveals the scam.
How to check if your Chrome is actually up to date
To avoid falling into this trap, the easiest thing to do is ignore any pop-up windows that ask you to download files. If you have any doubts about your browser's status, you can check it manually. Open Chrome, click the three-dot menu in the upper right corner, go to 'Help', and select 'About Google Chrome'. The browser will automatically check for updates and, if any are available, install them without needing to download anything external.
This process is identical in Brave, Opera, and other Chromium-based browsers. The golden rule is that no legitimate update requires you to download an executable file from a pop-up window . If a page asks you to do that, it's a clear red flag.
What to do if you have already downloaded the file
If you've already clicked a suspicious alert button and downloaded an .exe or .vbs file, don't open it . Delete it immediately and run a full security scan with your antivirus software. If you've already run it, proceed with caution: avoid entering passwords or sensitive information on your computer until you're sure it hasn't been compromised.
It's also advisable to review your installed extensions and remove any add-ons you don't recognize or no longer use. If the problem persists, you can reset Chrome's settings from the settings menu. In work environments, this review should be even more thorough, as an infected computer can compromise corporate data or shared accounts.
In short, this is a malware campaign that exploits trust in browser notifications. The best defense is prevention : don't download files from pop-ups, keep only the necessary extensions, and always check for updates from the official menu. With these habits, it's very difficult to fall into the trap.
