Tracked campaign: Gameograf / Ovkas wallpaper adware

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by raw.githubusercontent.com

Chrome Web Store Verified

Power Chainsaw Man Live Wallpaper

by [email protected] · 103 users · 4.3 rating
3de3a609-8ba7-5fc6-893a-3a8d813413c7 | v4.61
56/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
1 weeks ago
Version
v4.61
Artifact
SHA256 D7F…7AA
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

50 detail rows

YARA Rule Matches

10 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall persistence mechanism 1
js/background.js
-
LOWpostinstall file manipulation 14
js/dragPopup.jscss/style.cssjs/calendar.js +11 more
-
LOWpostinstall crypto operations 3
_metadata/verified_contents.jsonjs/jquery-3.7.1.min.jsjs/script.js
-
LOWpostinstall network communication 7
js/chatgpt.jsjs/countdownTimer.jsjs/background.js +4 more
-
LOWpostinstall obfuscation 4
js/sidePanel.jsjs/background.jsnewtab.html +1 more
-
LOWpostinstall system command 2
img/bg.mp4js/jquery-3.7.1.min.js
-
LOWpostinstall file download 5
js/sidePanel.jsjs/weather.jsjs/background.js +2 more
-
LOWSQLInjection 3
js/script.jsjs/jquery-3.7.1.min.jsjs/todo.js
-
LOWNoUseWeakRandom 2
js/createStickyNote.jsjs/jquery-3.7.1.min.js
-
LOWLocalStorageShouldNotBeUsed 3
js/createStickyNote.jsjs/script.jsjs/todo.js
-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

109 total

Loading network indicators

IoC detail rows are loaded outside the initial page render.

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

51
Noisy-finding weight
x1.00
Publisher domain
gameograf.com
Observed
Store verification signal
Limited signal
Limited
Extension portfolio
1.6K
Portfolio

11 evidence rows available.

Finding Categories

6
Network
109
IoC Indicators

YARA Rules Matched

10 rules(44 hits)
postinstall persistence mechanism postinstall file manipulation postinstall crypto operations postinstall network communication postinstall obfuscation postinstall system command postinstall file download SQLInjection NoUseWeakRandom LocalStorageShouldNotBeUsed

Requested Permissions

4 permissions
search
Low
alarms
Low
storage
Low
https://api.gameograf.com/*
Low

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality weak.

The CVEQ analysis bundle for 'Power Chainsaw Man Live Wallpaper' (version 4.60) contains an empty findings_by_category object, meaning zero security findings were detected across all categories. This extension presents as a live wallpaper for the anime series Chainsaw Man, which is a legitimate use case for browser extensions.

The developer attribution shows an email address ([email protected]) rather than a verified company name, which is common for smaller developers but prevents verification of publisher identity. The user count of 78 is very low, indicating this is a niche extension without widespread adoption. However, low user count alone does not indicate malicious intent.

Critically, the findings_by_category object is completely empty. There are no IoC findings (no suspicious domains, IPs, or URLs), no code-smell findings (no YARA rule matches), no obfuscation findings, and no malware signatures. This is a stark contrast to the typical pattern where even benign extensions trigger numerous false-positive findings from bundled dependencies, minified code, or generic code patterns.

The strongest counterargument to this verdict would be that the empty findings bundle represents a scan failure rather than a clean result. A skeptic might argue that without evidence of what files were scanned or how many files were analyzed, we cannot confirm the scan ran properly. However, the version field shows '4.60' (not 'unknown'), and the extension metadata is complete (name, description, developer, user count, store, uuid). If this were truly incomplete_data, we would expect missing or placeholder values in these fields. The extension has a coherent purpose (live wallpaper), a descriptive title, and emoji in the description consistent with legitimate anime fan content.

Given the complete absence of any findings and the legitimate-sounding functionality, the appropriate classification is likely_false_positive. The scoring system may have inflated risk metrics due to the absence of data, but the actual evidence shows no malicious indicators. The recommended action is to monitor rather than escalate, as there is no evidence of harm.

Key Reasons

  • Zero findings detected across all categories
  • Legitimate live wallpaper use case
  • No suspicious domains or code patterns identified
  • Complete metadata present

False Positive Considerations

  • empty_findings_bundle
  • low_user_count
  • email_developer_attribution

Reviewed 2026-04-26; recommended action: monitor; model confidence 85%.

About This Extension

Power Chainsaw Man Live Wallpaper features a dynamic HD live wallpaper designed around its visual theme, bringing the subject into every new tab with a continuously looping scene. Extension Features 🎞 Power Chainsaw Man Live Wallpaper Video – Dynamic HD looped live wallpaper. 🔗 Popular Shortcuts – Quick access to YouTube, Netflix, ChatGPT, Amazon, and more. 🞞 Custom Shortcuts – Add your favorite websites for instant access. 🔍 Search Bar – Works seamlessly with your default search engine. 🕒 Clock & Date – Minimalist, always-on time & date widget. 📝 Sticky Notes – Colorful, draggable notes on your new tab. 🔔 Notifications – Get alerts about new wallpapers & features. 📧 Google Apps – One-click access to Gmail, Maps, Drive, and more. 🤖 ChatGPT Widget – Ask questions and get instant AI-powered answers. ✅ To-Do List – Organize your daily tasks directly on your new tab. 📅 Calendar Tool – Keep track of important dates. 🧮 Calculator – Perform calculations without leaving Chrome. ⏳ Timer – Built-in countdown for productivity or breaks. 🛠 More Tools – Includes privacy settings, uninstall guide, and support. About Us Gameograf.com develops premium Chrome new tab themes designed for anime, gaming, cars, celebrities, sports, and more. Enjoy visually stunning and immersive browsing experiences with every extension. 🌐 Website: https://gameograf.com 📩 Contact: https://gameograf.com/contact-us/ 🔒 Privacy Policy: https://gameograf.com/privacy-policy/ 💬 Feedback: https://gameograf.com/feedback/ 📧 Email: [email protected] Affiliate Policy Notice This extension opens a new tab at https://gameograf.com. Some links on our website including Amazon links may contain affiliate tracking. If you purchase through these links, Gameograf.com may earn a small commission, helping us maintain and improve our free extensions.

Frequently Asked Questions