152 Chrome Live Wallpaper Extensions Ran Ad-Tracking and Traffic-Laundering Scheme

Researchers uncovered a coordinated operation on the Chrome Web Store involving 152 “live wallpaper” new-tab extensions spread across 38 publisher accounts and three backend brands, with roughly 105,000 reported installs. Built from a shared codebase, the extensions redirected install and uninstall traffic to operator-controlled infrastructure and monetized users through ad-driven destination pages including tabplugins.com, yowgames.com, chromewallpaper.com, and owhit.com. Investigators said the campaign functioned as an adware-adjacent traffic-attribution fraud scheme, not a remote-code-execution or classic search-hijacking operation.

A 54-extension subset used a newer template that forged Google organic-search attribution and disguised uninstall activity as legitimate search-result clicks, inflating the apparent value of referral traffic and polluting analytics. The extensions also contained an undisclosed service-worker routine that repeatedly attempted to delete IndexedDB data, a behavior researchers described as anti-forensic even though it did not appear to affect website data outside the extension origin and was ineffective against the campaign’s current local-storage state. The report also cited false Chrome Web Store privacy disclosures and minor data leakage through favicon requests for saved shortcut domains, highlighting ongoing abuse of the browser-extension ecosystem for stealthy ad-fraud operations.