Gray Ravens Live Wallpaper New Tab

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

The "Gray Ravens Live Wallpaper New Tab" extension demonstrates multiple indicators consistent with browser hijacking behavior. The extension's description explicitly mentions "new tab" functionality, which is a common attack surface for hijacking extensions that replace users' new tab pages with monetized content.

The IoC findings reveal a concerning domain infrastructure. The domain ѷ.ovh contains a Cyrillic character (ѷ = Cyrillic small letter yot), which is a known tactic for obfuscating malicious infrastructure. Similarly, ҫ.br contains a non-standard character that could indicate domain generation or obfuscation attempts. These are not typical false positives from the IoC extractor, which usually produces garbage like b.call or h.next from property access chains.

Multiple short, generic domains appear in the findings: e.tf, s.bn, popup.id, db.name, g.pk, t.jp, z.bo, and s.at. The domain popup.id is particularly concerning given the extension's new tab functionality—this naming pattern is consistent with adware/hijacking infrastructure designed to serve monetized content. Combined with the extension's purpose of modifying the new tab page, these domains suggest the extension routes users to third-party content for ad revenue.

The legitimate-looking domains gameograf.com (matching the developer email) and ssl.gstatic.com (Google CDN) provide some counterbalance, but they do not explain the presence of the suspicious Cyrillic and short domains.

Counterargument: A skeptic might argue that the zero malware signatures and zero obfuscation findings indicate this is a false positive. However, browser hijacking and PUP behavior often do not trigger malware signatures because the code itself may be benign—it simply redirects to monetized pages. The absence of obfuscation does not rule out hijacking behavior; many hijackers use straightforward code to change browser settings. The specific nature of the suspicious domains (Cyrillic characters, generic short domains) combined with the new tab functionality provides stronger evidence than the mere absence of malware signatures.

The extension should be flagged for browser hijacking risk due to the suspicious domain infrastructure and new tab modification capability.

Key Reasons

• Cyrillic character domain ѷ.ovh indicates obfuscated infrastructure
• Multiple short/generic domains (e.tf, s.bn, popup.id) typical of hijacking
• New tab page functionality commonly abused for monetization
• Zero malware signatures but suspicious domain patterns present
• Developer uses email address rather than verified company name

False Positive Considerations

• IoC extractor volume inflation
• Generic short domain patterns may be legitimate services
• Code-smell findings (36 total) are known noise sources

Reviewed 2026-05-08; recommended action: monitor; model confidence 75%.