152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic
152 Chrome wallpaper extensions hid ad tracking and faked Google search traffic.
Summary
A family of 152 Chrome 'live wallpaper' extensions, built from a single codebase but distributed across 38 publisher accounts, have been found to log user data and share it with ad partners, despite claiming otherwise in their store listings. A subset of these extensions also faked Google search traffic attribution to inflate website popularity and trust, a deceptive practice that pollutes analytics data for websites, ad networks, and Google itself. The extensions are described as adware-adjacent potentially unwanted programs (PUPs) with concrete harms including deceptive traffic measurement, undisclosed telemetry, and false privacy disclosures, affecting an estimated 100,000 users.
Full text
Security Newsnpm Tooling Bug Incorrectly Marks One-Character Packages as Security Holdersnpm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.By Sarah Gooding - Jun 09, 2026
Indicators of Compromise
- domain — tabplugins.com
- domain — yowgames.com
- domain — chromewallpaper.com
- domain — owhit.com
- url — https://tabplugins.com/tanjiro-demon-slayer-live-wallpaper/?utm_source=google&utm_medium=organic&utm_campaign=tanjiro-demon-slayer-live-wallpaper
- url — https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://tabplugins.com/live-wallpaper/&ved=2ahUKEwigjZv3_sqUAxWaTKQEHVVYOFUQFnoECB4QAQ&usg=AOvVaw3S1cD8TWcvQUivIwcBGtSp
- email — hirakiranpk@gmail.com
- email — hussnain1122akram@gmail.com
- email — ferhatbadem831@gmail.com
- email — keremsopar@gmail.com
- email — yahyagazi06@gmail.com
- email — support@owhit.com
- url — https://avads[.]live/s/av-tabplugins.js
- mitre_attack — T1176.001
- mitre_attack — T1036
- mitre_attack — T1070
- mitre_attack — T1071.001
- mitre_attack — T1583.001