Malicious Chrome Extensions Exposed in Mass Production Traffic Fraud Scheme

Socket's Threat Research Team uncovered a sprawling ad-fraud campaign of 152 malicious Chrome extensions disguised as 'live wallpaper' add-ons that log user data and launder advertising traffic by forging Google organic-search attribution; the network used 38 publisher accounts and multiple brand backends to evade takedowns, accumulated about 105,000 installs, opened hidden tabs to load programmatic ad stacks for monetization, and included an anti-forensic IndexedDB deletion routine, causing privacy leaks and polluted analytics.