Malicious 152 Chrome Extensions Caught Spoofing Google Organic Search Traffic

Socket’s Threat Research Team uncovered a large-scale campaign of 152 malicious Chrome extensions (≈105,000 installs) disguised as live wallpaper/new-tab add-ons that harvest telemetry and fraudulently generate organic Google search attribution to monetize via ad networks; the report details behavioral TTPs (bg.js forced install tabs with utm parameters, uninstall URL cloaking using google.com/url wrappers, an IndexedDB enumerate-delete anti-forensics loop), associated domains/IPs, and recommended detection/remediation steps.