152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic

Summary: Researchers at Socket found 152 Google Chrome extensions posing as new-tab live wallpaper add-ons that distribute a potentially unwanted program family, spread across 38 Chrome Web Store publisher accounts and three brand backends: tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com. The extensions have been installed 105,000 times, and a sub-cluster hard-codes two URLs in a JavaScript file that fire on install and uninstall to fabricate Google organic search traffic, including the signed ved and usg tokens Google uses for real search-result clicks.
Why it matters: Every one of these listings told users it would not collect or use their data while its linked privacy policy admitted it logs IP addresses, ISP, click counts, and referrers and shares them with Google AdSense, DoubleClick, and third-party ad partners - a gap 105,000 installs wide between what the store page promises and what the code does.

Read the original at The Hacker News ↗