Cybercriminals are currently tricking Windows users with pop-up windows mimicking critical updates for Chrome, Brave, and Opera. Clicking these alerts downloads a malicious file that secretly turns your computer into a cryptocurrency mining tool. Find out how to easily spot this scam and effectively protect your device.

How the Deception Works

While browsing, a pop-up window appears with urgent messages like 'A critical update is required' or 'An update is available'. Some variants even warn that the browser might stop working if the installation is delayed. However, this alert does not come from Google or the browser developers.

If the victim clicks the button, a file with a .vbs or .exe extension is downloaded from an external source. The infection occurs when the user opens that file and authorizes its execution. Once installed, the malware uses the processor and graphics card to mine cryptocurrencies without your consent.

Signs Your PC Might Be Infected

  • Noticeable drop in overall system performance.
  • Increased temperature and fans running constantly.
  • Higher electricity consumption.

The Extension Flagged as a Possible Origin

Reports on Reddit and a technical report on the Chromium tracker point to the extension 'Enable Right Click & Copy — Smart Unlock + OCR', a tool designed to enable right-clicking and copying protected texts. It is suspected that the extension may have been purchased or altered by third parties with malicious intent, as it is not confirmed that the original creators are responsible.

Important: This extension connects to external servers and can load unauthorized content, such as the fake pop-ups. If you have it installed, removing it significantly reduces the risk.

How to Update Chrome Safely

Legitimate Chrome updates never come through pop-ups. They are managed automatically by the browser itself. To check manually:

  1. Open Chrome from its icon.
  2. Click the three-dot menu (top right).
  3. Go to Help and then About Google Chrome.
  4. The browser will search for updates and prompt a restart if necessary.

This procedure is identical in Brave and Opera. If a window asks you to update Chrome while you are in another browser, it is a clear sign of fraud.

What to Do If You Already Downloaded the Suspicious File

If You Did NOT Execute It

Delete the .vbs or .exe file from your computer, empty the recycle bin, and verify there are no copies in your downloads folder.

If You ALREADY Executed It

Perform a full scan with Windows Security (or your antivirus). Avoid entering passwords or banking details until you confirm the computer is clean.

Additional Protection Steps

  • Review your extensions: remove unknown or unnecessary ones.
  • Reset Chrome: if alerts continue, you can reset the browser to its original state from Settings.
  • Distrust urgency: cybercriminals use alarmist messages to make you act without thinking.

Advice for Businesses and Users

In work environments, the risk is higher: an infected computer can compromise corporate documents or shared accounts. Establish a clear rule: updates are only done from the program or its official website, never from pop-ups.

Digital protection begins with a simple decision: do not download something just because a window says you should. A legitimate Chrome update will never ask you to run external files.

Source: Reports dated August 16, 2026. Read the original coverage at Imago.