Google removes 152 malicious Chrome wallpaper extensions

Security researchers uncovered a coordinated campaign of 152 Chrome extensions disguised as live‑wallpaper add‑ons. The extensions were published under 38 separate accounts and three brand domains—tabplugins.com, yowgames.com and chromewallpaper.com—and amassed roughly 105,000 installations.

The add‑ons collected users' IP addresses, ISP information, click counts and referrer data, funneling it to Google AdSense, DoubleClick and other advertising partners. They also generated fraudulent Google search clicks: on installation they injected tracking parameters that mimic organic search traffic, and on uninstallation they triggered a final redirect that imitates a genuine click on a Google result. Kush Pandya, a researcher at Socket, said, “Each entry claims no data collection, while the linked privacy policy admits the opposite.”

Google has now removed all 152 extensions from the Chrome Web Store. Analysts note code similarities and infrastructure point to a Turkish origin for the operation.