152 'live wallpaper' Chrome extensions caught harvesting user data and faking Google search traffic

On 13 June 2026, Socket's Threat Research Team disclosed a coordinated family of 152 "live wallpaper" new-tab extensions on the Google Chrome Web Store that secretly logged user data and manufactured fake Google "organic search" traffic — all while their store listings explicitly promised they collected no data at all.

What happened

The extensions were built from a single shared codebase but distributed across 38 publisher accounts and three brands — tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com (which redirects to owhit[.]com) — to spread the campaign across many listings and blunt the impact of any single takedown. Using popular themes such as anime, games, football and car wallpapers to attract installs, the extensions together reported roughly 105,000 users.

Despite each Chrome Web Store listing declaring that no user data was collected, the extensions aggressively harvested telemetry in the background. The operator's own external privacy policy contradicted those listings, admitting to logging IP addresses, internet service provider (ISP) data, click counts and referrer data. Rather than injecting ads into arbitrary websites, the extensions redirected users to operator-controlled, programmatically monetised domains.

Why it matters

This adware-adjacent campaign abused new-tab extensions to launder extension-generated visits into what looked like legitimate Google organic search traffic, polluting analytics for advertisers and Google alike while quietly profiting from the redirected clicks. The gap between the "no data collected" store labels and the operator's actual privacy policy highlights how easily Chrome Web Store disclosures can be gamed — and how a single codebase, fanned out across dozens of publisher accounts, can quietly reach six figures of users before researchers connect the dots.