Socket: 152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic

What it is

A family of 152 Chrome Web Store new-tab "live wallpaper" extensions (Socket Threat Research, by Kush Pandya), built from one shared codebase, spread across 38 publisher accounts and three brand backends (tabplugins-brand being the newer template), ~105,000 installs. Classed as adware-adjacent PUP. The harm is deceptive traffic measurement, undisclosed telemetry, and a provably false "no data collected" store disclosure that the linked privacy policy contradicts.

How it works

The service worker js/bg.js hardcodes two URLs and fires them on lifecycle events:

• Install (chrome.runtime.onInstalled): force-opens a tabplugins[.]com tab tagged utm_source=google&utm_medium=organic&utm_campaign=..., stamping self-generated traffic as Google organic search. It also opens newtab.html.
• Uninstall (chrome.runtime.setUninstallURL): fires a https://www.google.com/url?... wrapper containing signed ved and usg tokens — the same format Google uses for real search-result redirects — so a tabplugins[.]com destination looks like a human clicking a Google result. This both phones home the uninstall and launders the referral.

The point is funnel monetization, not injection: forced, falsely-attributed traffic feeds ad-monetized brand pages while the user is logged, and the identical template across dozens of accounts means no single takedown dents the network.

Separately, 100% of the family ships an IndexedDB enumerate-and-delete routine that runs on every service-worker start — anti-forensic in design but inert in this build; it deletes nothing.

What to do

The page gives no patch or command — actions are detection/hunting:

• Flag extensions whose install fires a chrome.tabs.create to an external domain tagged utm_source=google&utm_medium=organic.
• Flag setUninstallURL values wrapping a google.com/url redirect with ved/usg tokens pointing to a non-Google destination.
• Treat inbound "organic" traffic carrying these hardcoded campaign params as fabricated; discount it in analytics/ad-attribution.
• Domain IOC: tabplugins[.]com.

Caveats

The article text cuts off mid-section on the IndexedDB code. The wipe routine is confirmed inert in the analyzed build — a future update could arm it. Only the 54-listing tabplugins-brand subset performs the traffic-laundering; all 152 share the false disclosure and dormant wipe.