152 Chrome Wallpaper Extensions Caught Faking Google Traffic and Harvesting User Data
A network of 152 Google Chrome wallpaper extensions with more than 105,000 combined installs has been caught secretly tracking users and manufacturing fake Google search traffic to defraud advertisers, according to a Socket Threat Research Team investigation published this week.
The extensions, themed around anime, football clubs, gaming franchises, and luxury cars, run silently in the background and instruct web analytics software to register a fake human-generated Google Search click — both when a user installs the extension and again when they remove it.
How the Scheme Works
Each extension, once installed on Chrome, Microsoft Edge, Brave, Opera, or Vivaldi, opens a hidden tab and sends a signal to analytics platforms that mimics a genuine organic search visit originating from Google.
That fabricated traffic makes the operators’ affiliated websites appear far more popular and authoritative than they actually are, which in turn commands higher advertising rates from ad networks that pay a premium for organic search engagement.
A Deliberate Privacy Deception
Socket researchers found a direct contradiction between what the extensions declare on the Chrome Web Store and what their actual privacy policies say.
On the store listing, the extensions state they collect no user data. Their linked privacy policies, however, openly disclose that operators log each user’s IP address, internet service provider, and click behavior, then share that information with third-party advertising networks.
Built to Survive Takedowns
The operators distributed the same underlying code across 38 separate publisher accounts and three primary brand names: TabPlugins, YowGames, and ChromeWallpaper.
That structure means a ban on any single developer account leaves the rest of the network intact and generating revenue — a deliberate redundancy designed to outlast platform enforcement actions.
Among the live extensions Socket identified are Neymar – Football Live Wallpaper, Satoru Gojo Manga Live Wallpaper, Hello Kitty Wallpapers HD New Tab, Minecraft Sakura Pond Live Wallpaper, Lamine Yamal Wallpapers HD Football, Arsenal FC Flag Live Wallpaper, and BMW M3 Neon Night Drive Live Wallpaper.
Socket’s full published list runs to 152 active extensions, plus 11 additional extension IDs it flagged as already delisted from the Chrome Web Store at the time of the report.
What Users Can Do Now
Anyone who has recently installed a live wallpaper or custom new-tab extension should review their browser’s extension settings and remove anything that requests permission to override the New Tab Page or the default search engine.
Google has not publicly commented on the findings. Socket said it notified the company before publishing.
Browser extension abuse has drawn growing regulatory scrutiny. The European Union’s Digital Markets Act, which took full effect in March 2024, imposes stricter obligations on browser gatekeepers to vet third-party add-ons — though enforcement against specific extensions remains limited in practice.
