If you've recently seen a pop-up window asking you to install a critical Chrome update , ignore it. It's a malware campaign circulating that exploits user trust to sneak dangerous files onto their computers. The alert, which perfectly mimics the style of legitimate notifications, has been reported on forums like Reddit and has already affected users of Chrome, Brave, and Opera.
The scam is simple but effective: clicking the update button, instead of starting the normal process, downloads an executable file with the .exe or .vbs extension. If the user opens it, the malware can take control of the computer and use it to mine cryptocurrencies, among other things. Most worryingly, some antivirus tools fail to detect the threat , while Windows Defender has managed to block some downloads.
How does the scam work?
The messages pop up suddenly while you're browsing and use alarmist language, such as "Critical update required" or "An update is available." Some even warn that the browser will stop working if the update isn't installed immediately. The intention is to get you to act impulsively and click the button. However, legitimate Chrome updates are never downloaded from a pop-up window . They are always managed from within the browser itself, via the three-dot menu and the option 'Help' > 'About Google Chrome'.
Once the user clicks the button, the system downloads a .vbs script or an .exe file from an external source. The infection is complete when the user opens that file and authorizes its execution. From there, the malware can use the computer's resources to mine cryptocurrency without the user's knowledge. Typical symptoms include decreased performance, increased power consumption, and constantly running fans.
The extension under suspicion
Reports gathered on Reddit point to a specific extension as the likely culprit: Enable Right Click & Copy Smart Unlock + OCR . This tool, designed to allow users to copy protected text and recognize words in images, has been mentioned in several threads. It's unclear whether the original creators are behind the attack or if the extension was compromised by a third party. In fact, Google hasn't removed the extension from the Chrome Web Store, adding to the confusion.
What does seem confirmed is that the extension can act as an intermediary, connecting to external servers to load the fake pop-ups. This would explain why the problem isn't limited to Chrome, but also affects Chromium-based browsers like Brave and Opera. In some cases, the notification prompts you to update Chrome while another browser is being used, a contradiction that reveals the scam.
How to distinguish a legitimate update
The golden rule to avoid falling into this trap is to remember that legitimate Chrome updates are never downloaded from pop-up windows . They are managed exclusively through the browser's own menu. If you have any doubts about your browser's status, you can easily check it by accessing the three-dot menu and going to Help > About Google Chrome. The steps are identical in Brave and other Chromium-based browsers.
It's important to note that some traditional antivirus programs, such as Malwarebytes, failed to detect infections after the file was downloaded, while Windows Defender did block the download in some cases. This initial lack of detection does not mean the file is safe; malicious files can remain dormant until the user manually executes them . Therefore, the recommendation is to never install or open executable files downloaded from unknown sources.
What to do if you've already taken the bait
If you clicked a suspicious alert button and downloaded a file, but haven't opened it yet, the best course of action is to delete it without running it and perform a full security scan of your computer. If the file has already been opened, it's advisable to avoid entering passwords or sensitive information on your computer until you're sure it hasn't been compromised. Additionally, it's a good idea to review and remove installed file extensions, especially those you don't recognize or that have started behaving strangely.
For those who use computers in work environments or access sensitive information, the review process should be even more rigorous, as an infected computer can compromise corporate data or shared accounts. A practical measure is to establish a clear rule: software updates should be performed directly from the program itself or its official website , never from unknown pop-up windows. It is also helpful to keep only the necessary extensions in corporate browsers.
Protection in work environments
The risk isn't limited to home users. In a business, a seemingly small download can become a major problem if the affected computer has access to documents, corporate accounts, or tools used by other employees. Establishing a clear policy on updates and extensions is crucial to reducing the attack surface. Employees should be able to recognize messages that try to provoke an immediate reaction and, if in doubt, consult the IT department.
In addition, it's advisable to periodically review the extensions installed in the company's browsers and remove any that are no longer used. If an extension exhibits unusual behavior, it's best to remove it immediately. Basic cybersecurity training can be far more effective than memorizing hundreds of types of threats.
When an unexpected window pops up while you're browsing, asking you to download a file to update Chrome, the best thing to do is close it, open the browser directly, and check its status under Help > About Google Chrome. If the notification disappears when you close the page or continues to appear, review your installed extensions and run a security scan. Recognizing these warning signs can prevent bigger problems for both home users and businesses. Digital security often starts with a very simple decision: don't download something just because a window tells you to.