Socket’s Threat Research Team uncovered a coordinated family of 152 new‑tab “live wallpaper” Chrome extensions built from a single codebase but spread across 38 publisher accounts and three brands: tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com (which redirects to owhit[.]com).
On their Chrome Web Store “Privacy practices” tab, the listings state that the extensions do not collect or use user data, do not sell data, and do not transfer data for unrelated purposes.
However, the linked privacy policy clearly states that it logs IP addresses, browser type, ISP, timestamps, referring pages, click counts, and details about the user’s device and installed software, which are shared with Google AdSense, DoubleClick, Google Analytics, and unnamed third‑party ad partners.
152 Chrome "live wallpaper" extensions logged user data and faked Google search traffic for ad revenue.
cybersecuritynews.com