152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Fake Search Clicks

Socket’s Threat Research Team discovered a network of 152 Chrome "live wallpaper" extensions (about 105k installs) that used a shared codebase across multiple publisher accounts and three main domains to drive users into ad-monetized funnels, log install/uninstall events, and fake Google organic search clicks to inflate traffic and ad revenue; the extensions also misrepresented their data collection practices and included a distinctive (but mostly ineffective) IndexedDB deletion routine. Researchers describe the activity as deceptive adware/traffic attribution rather than classic malware, published IoCs (publisher accounts, domains, extension IDs, analytics/ads IDs), and advised users to remove extensions tied to tabplugins.com, yowgames.com, chromewallpaper.com, and owhit.com.