Threats · 91 days ago
A distributed extension network can launder both user data and traffic provenance inside trusted browser software, so a listing review or single-account takedown misses the real blast radius. Here, 152 Chrome live-wallpaper extensions spread across 38 publisher accounts and three brand backends shared one codebase and about 105,000 installs, which let the operation look independent while feeding one monetization system.
The listings said they would not collect user data, but the linked privacy policy admitted logging IP addresses, ISP, click counts, and referrers and sharing them with Google AdSense, DoubleClick, and other ad partners. A 54-listing subset also forged Google organic-search attribution and made uninstall traffic look like a real Google search-result click, turning extension-driven visits into fabricated “earned” traffic.
That matters for Chrome Web Store trust and safety, ad-tech, affiliate fraud, and analytics teams because the source of a visit can be manufactured inside a client users already trust. The same failure mode can pollute measurement and partner attribution even when the browser extension itself looks like a harmless wallpaper add-on.
2 sources covering this story
152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic
Researchers found 152 Chrome extensions with 105,000 installs tied to adware, data collection, and fake Google organic traffic.
152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Fak...
A network of 152 Chrome live wallpaper extensions hid ad tracking and made extension-driven traffic look like Google search clicks.
Part of the PlainSec briefing for 2026-06-13