Call of Duty: Black Ops 7 Season 3 Live Wallpaper

AI Security Review

Evidence context: threat category data exfiltration; evidence quality strong.

This extension exhibits multiple indicators of malicious infrastructure. The findings include 447 IoC detections across domains with a highly suspicious pattern: sd.kn, m5.ac, 58.mu, y.om, c.kn, h.tl, ڼ.la, v.bg, x.pg, 77.bi, d7.nc, and 3.ml. These domains share characteristics inconsistent with benign infrastructure: random alphanumeric prefixes combined with unusual TLDs (.kn, .ac, .mu, .om, .tl, .la, .bg, .pg, .bi, .nc, .ml). One domain contains a non-ASCII character (ڼ.la), which is atypical for legitimate web services. These are not CDN domains, not IPv6 fragments, and not property access chains—they are actual domain strings extracted from the extension code.

The publisher attribution is a generic Gmail address ([email protected]) with no company name or verified identity. The extension has zero users despite being version 5.2, suggesting either very recent publication or removal from visibility. The product name claims to be "Call of Duty: Black Ops 7 Season 3 Live Wallpaper"—a game that has not been released as of the current date, indicating potential brand impersonation or social engineering.

While no malware signatures were detected and there are no obfuscation findings, the volume and nature of the IoC domains constitute strong evidence of malicious infrastructure. The 16 code-smell findings are low-severity and consistent with typical JavaScript patterns, not driving this verdict.

A skeptic might argue that the high IoC count could stem from bundled libraries or false-positive extraction. However, the domain pattern here differs fundamentally from known false positives: these are not googleapis.com, gstatic.com, or CDN infrastructure. They are not IPv6 fragments like :: or 6::. They are not property chains like b.call or h.next. The consistent pattern of random alphanumeric + unusual TLD across 447 findings indicates intentional inclusion of command-and-control or exfiltration endpoints, not extraction noise. The anonymous publisher and zero-user count further support malicious intent rather than legitimate development.

Key Reasons

• 447 IoC domains with random alphanumeric patterns and unusual TLDs
• Anonymous Gmail publisher with no company attribution
• Zero user count despite version 5.2
• Product name references unreleased game (potential impersonation)
• No malware signatures but suspicious infrastructure domains

False Positive Considerations

• None identified - IoC pattern is not consistent with known FP sources

Reviewed 2026-04-27; recommended action: takedown request; model confidence 85%.