logo

105K Chrome Installs Linked to Adware and Fake Google Traffic

ID: 5a43d1bc-7417-5c42-9313-7ab19b8c02f3

STIX ID: report--5a43d1bc-7417-5c42-9313-7ab19b8c02f3

Feed Name: TechRepublic Security

Threat Score
65/100

Date Published: 2026-06-17

Date Updated: 2026-06-17

Author: Aminu Abdullahi

...
...

Security researchers uncovered a coordinated campaign of 152 malicious Chrome extensions (105,000+ installs) masquerading as wallpaper and new-tab tools that secretly logged IPs, device and browser details, and click activity, then opened and redirected tabs to manufacture ‘organic’ Google search traffic for ad and affiliate monetization; the operation reused a shared codebase across domains (tabplugins.com, yowgames.com, chromewallpaper.com) and included a dormant IndexedDB-deletion capability.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.