What Happened: Wallpaper Extensions Turned into Chrome Adware
The Chrome wallpaper extension campaign is a coordinated set of browser add-ons that pose as live wallpaper and new-tab themes while secretly distributing adware, fabricating search traffic, and collecting user data from more than one hundred thousand installations. Security researchers from Socket uncovered a cluster of 152 Chrome extensions, spread across 38 publisher accounts and tied to three backend brands: Tab Plugins, Yowgames, and chromewallpaper.com. According to Socket’s Threat Research Team, these add-ons were promoted as anime, gaming, and car wallpapers with names like Neymar – Football Live Wallpaper and Hello Kitty Wallpapers HD New Tab, but they behaved like a financially motivated adware operation. They were hosted on the official Chrome Web Store, and every listing claimed that no user data would be collected, while their linked privacy policies admitted logging IP addresses, ISP information, clicks, referrers, and sharing this data with advertising partners.
How the Extensions Faked Google Traffic and Abused Search Signals
This campaign exploited Chrome extension security gaps by turning harmless-looking wallpaper extensions into tools for traffic fraud. The extensions used hard-coded URLs in a JavaScript file (js/bg.js) that triggered when users installed or removed them. On install, the code opened a tab with UTM parameters such as utm_source=google and utm_medium=organic, making it appear that visits came from real Google organic search results rather than from a script. On uninstall, they routed browsers through a google.com/url redirect wrapper, including Google-style ved and usg tokens, so that affiliate programs and advertisers saw fabricated clicks as genuine search activity. Socket described this as “a financially motivated commercial adware and traffic-attribution-fraud affiliate operation.” The aim was to fake search traffic signals, mislead advertisers about user interest, and profit from manipulated attribution data while hiding behind colorful wallpaper themes.
What Data These Wallpaper Extensions Collected and Why It Matters
Behind the anime characters and football stars, the wallpaper extension malware quietly harvested a steady stream of Chrome data. Their own privacy policies disclosed collection of IP addresses, internet service provider details, browser and device information, click counts, referrers, and timestamps. This data was shared with Google AdSense, DoubleClick, and unnamed third-party ad partners, turning users’ browsing behavior into fuel for ad profiling and traffic resale. Some JavaScript files also contained dormant logic to enumerate and delete IndexedDB databases when a service worker started, signaling a dangerous ability to tamper with stored web data. Chrome data theft on this scale can expose session tokens, weaken account security, and degrade browser performance through constant background requests and injected tabs. Because users installed these extensions from the Chrome Web Store, many assumed they were safe, highlighting how platform vetting gaps let potentially unwanted programs pass as legitimate customization tools.
How to Audit Your Browser and Remove Adware Extensions
To remove adware extensions and regain control of your browser, start by auditing everything installed in Chrome. Open the three-dot menu, choose Extensions, then Manage Extensions. Disable and then remove any wallpaper, new-tab, or theme extension you do not recognize, no longer use, or that requests access to "all websites" without a clear reason. Restart Chrome afterwards, and if sync is enabled, repeat the cleanup on every device linked to your Google account before turning sync back on so malicious items do not reappear. Change passwords for email, banking, social media, and any service you accessed while suspicious extensions were installed. Consider resetting Chrome’s settings or creating a fresh profile if you notice lingering redirects or slowdowns. For better Chrome extension security going forward, favor well-known developers, read privacy policies before installing, and be especially skeptical of cosmetic add-ons that demand broad permissions for simple wallpaper features.
