Digital Deception: 152 Chrome Wallpaper Extensions Unmasked as Adware and Traffic Fraud Ring

The Deceptive Lure of Digital Wallpapers

What appears to be a harmless aesthetic upgrade for your browser could, in fact, be a sophisticated digital trap. Cybersecurity researchers have recently unveiled a sprawling network of 152 Google Chrome extensions, masquerading as vibrant new tab live wallpaper add-ons, that are secretly distributing a family of potentially unwanted programs (PUPs). This elaborate scheme has already ensnared over 105,000 users, highlighting a significant and often overlooked threat within the Chrome Web Store.

Anatomy of a Cyber Deception

This extensive operation isn’t the work of a lone wolf. The malicious cluster is spread across 38 distinct Chrome Web Store publisher accounts, all funneling back to three primary brand backends: tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com. The sheer scale suggests a well-organized, financially motivated campaign.

Popular Themes, Hidden Dangers

The extensions leverage popular culture and interests to attract users, ranging from sports stars to anime characters and luxury cars. Some examples include:

• Neymar – Football Live Wallpaper
• Satoru Gojo Manga Live Wallpaper
• Porsche 911 – Sports Car Live Wallpaper
• Hello Kitty Wallpapers HD New Tab
• Spider-Man Miles Morales Swing Live Wallpaper
• BMW M3 Neon Night Drive Live Wallpaper
• Death Note Anime Wallpapers HD New Tab
• Minecraft Sakura Pond Live Wallpaper

These seemingly innocuous names hide a darker purpose, turning users’ browsers into tools for illicit activities.

The Privacy Paradox: Promises vs. Reality

One of the most alarming aspects of this discovery is the blatant contradiction between the extensions’ public declarations and their actual practices. Every single listing on the Chrome Web Store explicitly states that it “will not collect or use user data.” However, as Socket security researcher Kush Pandya revealed, their linked privacy policies tell a starkly different story. These policies openly admit that the extensions log sensitive user data, including IP addresses, Internet Service Provider (ISP) details, click counts, and referrers. This data is then shared with major advertising platforms like Google AdSense, DoubleClick, and various third-party ad partners, turning user privacy into a commodity.

Fabricating Traffic: The Organic Search Illusion

Beyond data harvesting, these extensions employ sophisticated tactics to manipulate web traffic and attribution. A sub-cluster of these extensions contains hard-coded URLs within a JavaScript file (“js/bg.js”) that activate during both installation and uninstallation processes. This is where the true ingenuity of the fraud lies:

• Install Deception:

  Upon installation, the extension opens a new tab with a URL embedded with Urchin Tracking Module (UTM) parameters such as “utm_source=google&utm_medium=organic&utm_campaign=tanjiro-demon-slayer-live-wallpaper.” This cleverly disguises the extension’s self-initiated tab opening as an “organic” search visit from Google.

• Uninstall Masquerade: Even more cunning, the uninstall URL is a google.com/url redirect wrapper. This makes the uninstall activity appear as if a user genuinely clicked a Google search result, complete with signed ved and usg tokens that mimic legitimate Google Search clicks.

Socket researchers explain that this elaborate setup aims to artificially generate “organic” search signals, essentially fabricating the origin of its own traffic. “The visit is not a person who searched Google; it is the extension opening a tab on its own and stamping it ‘arrived from Google organic search,'” the company stated. This manipulation can skew analytics, inflate traffic numbers, and potentially defraud advertisers who pay for genuine organic engagement.

A Dormant Threat: IndexedDB Deletion

Adding another layer of concern, the JavaScript files within these extensions also harbor a dormant capability. This feature allows them to enumerate and delete every IndexedDB database they can locate upon a service worker’s start. While currently dormant, this capability poses a significant risk, as IndexedDB databases are used by websites to store large amounts of structured data client-side, potentially including sensitive user information or application data. Its activation could lead to data loss or further malicious activities.

A Global Operation with Local Roots?

The campaign is unequivocally identified as a “financially motivated commercial adware and traffic-attribution-fraud affiliate operation.” While the precise origins remain unconfirmed, circumstantial evidence points towards Turkey as a potential source. This highlights the global nature of cybercrime and the constant need for vigilance in the digital landscape.

Protecting Yourself

This discovery serves as a crucial reminder for all internet users to exercise extreme caution when adding extensions to their browsers. Always scrutinize privacy policies, even if the store listing claims otherwise, and be wary of extensions that request excessive permissions or exhibit unusual behavior. Regular security audits of your browser extensions can help safeguard your digital footprint from such sophisticated threats.

For more details, visit our website.

Source: Link