50+ Malicious Chrome Extensions Hit 30K Users

50+ malicious Chrome extensions posing as “live wallpaper” utilities have been caught running an adware operation that hijacks browser behavior and quietly pushes remote HTML content to around 30,000 users.

These extensions were distributed through at least three publisher accounts and made available via the Chrome Web Store and third‑party download portals that advertised animated wallpapers and aesthetic new‑tab pages.

Once installed, the extensions abused their elevated permissions to load operator‑controlled content, inject shortcuts, and aggressively display ads, turning what appeared to be cosmetic add‑ons into fully fledged adware delivery mechanisms.

The extensions rely heavily on remote HTML injection, regularly fetching HTML payloads from attacker‑controlled domains and rendering them inside popup containers without sanitization.

This gives the operators the flexibility to change ad templates, tracking hooks, and redirect chains server‑side, without pushing a new extension version through Chrome Web Store review.

Threat researchers at Unit 42 uncovered an adware campaign they track as Gameograf, involving more than 50 Chrome extensions marketed as “live wallpaper” new‑tab experiences.

On installation, the extensions trigger a forced tab redirect, opening a pre‑configured URL to drive traffic to specific ad‑monetized landing pages.

They also wipe IndexedDB databases on installation and at browser startup, a tactic likely designed to reset state, bypass local storage–based controls, and ensure their injected content loads fresh each session.

50+ Malicious Chrome Extensions

Key scripts inside these add‑ons periodically fetch JSON configuration files from Gameograf infrastructure, including a “shortcuts” resource that defines links rendered directly into the extension’s UI.

The extension parses this configuration and injects the remote HTML into the popup container, giving the actors fine‑grained control over user prompts, overlays, and click‑through funnels.

In addition to the Chrome Web Store listings, the campaign leverages wallpaper‑themed websites that promote “live wallpaper” new‑tab extensions.

These sites present curated galleries of wallpapers and categories, but their primary purpose is to funnel users toward the adware‑backed extensions by embedding direct installation links.

Because these extensions advertise themselves as harmless visual enhancements, they can easily attract non‑technical users, gamers, and fans of specific media franchises looking for themed wallpapers, helping the operators scale installations into the tens of thousands.

Victims primarily experience intrusive ads, forced redirects, and degraded browser performance as the extensions continuously load remote content and open new tabs.

However, the use of remote, unsanitized HTML and operator‑controlled configuration also introduces broader risk, as the same delivery pipeline could be repurposed for phishing flows, fake login prompts, or additional malware payloads.

Because the adware resets storage and controls its own configuration, users may find it difficult to fully understand why unwanted popups and redirects continue, especially if they install multiple wallpaper extensions from the same publisher ecosystem.

Security teams should monitor for the presence of Gameograf‑branded live‑wallpaper extensions and similar new‑tab add‑ons that request broad permissions and load external HTML.

Enterprise defenders can reduce risk by limiting installation of non‑essential browser extensions, enforcing allow‑lists through Chrome Enterprise policies, and flagging extensions that fetch remote configuration or HTML from untrusted domains.

End‑users should regularly audit their browser extensions, removing any unfamiliar live‑wallpaper or new‑tab extensions and scanning their systems with reputable security tools to clear residual adware components.

As this campaign shows, even seemingly cosmetic browser add‑ons can be weaponized into flexible adware and potential malware delivery platforms when operators maintain remote control over injected content.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.