152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic

Socket's Threat Research Team discovered a network of 152 Chrome Web Store extensions, masquerading as "live wallpaper" new-tab tools, which are built on a shared codebase but distributed across 38 different publisher accounts. These extensions, which have a collective install base of approximately 105,000, claim not to collect user data but are found to log information such as IP addresses and ISP details, sharing this data with Google AdSense, DoubleClick, and other advertising partners. A subset of these extensions deceptively manipulates Google organic search attribution, making extension-driven traffic appear as organic search traffic to inflate perceived popularity and trustworthiness for advertisers. The extensions also contain an anti-forensic IndexedDB wipe routine, a privacy policy contradiction concerning data collection, and a monetization strategy through ad-monetized brand pages. This operation is characterized by its deceptive traffic measurement, undisclosed telemetry, and resistance to takedown due to its distribution across numerous publisher identities. The family-wide behavior includes deceptive traffic laundering, a privacy policy contradiction, and the use of a shared extension template across multiple infrastructures, indicating a widespread and organized attempt to manipulate web traffic analytics and monetize through ad networks.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.