Asia Live Search

AI Security Review

Evidence context: threat category browser hijack; evidence quality strong.

This extension exhibits classic browser hijacking behavior. The extension description explicitly states it changes the default omnibox search to 'Asia Live Search,' and the evidence confirms redirection to the domain asialivewallpaper.com. Multiple URLs in the findings show this domain is used for search queries (https://asialivewallpaper.com/search?q=), session tracking on installation (https://asialivewallpaper.com/start?session=$), and session tracking on uninstall (https://asialivewallpaper.com/uninstall?session=$). This session parameter pattern indicates the extension reports user actions back to a third-party server.

The publisher identity is [email protected] — an anonymous Gmail address with no company attribution. Combined with 30,000 users, this suggests successful distribution of potentially unwanted software. The background.js:8 network finding confirms fetch calls are made from the extension's background script, consistent with the observed search redirection behavior.

Several findings are false positives that should not influence the verdict. The rules.map and rule.id IoC entries are property access chains misread as domains by the XIOC extractor. The www.inkscape.org domain references legitimate open-source graphics software. The clients2.google.com URL is Google's legitimate Chrome Web Store update endpoint. The postinstall_file_manipulation YARA rule is a code-smell pattern that matches basic Node.js operations and should not drive verdicts.

The strongest counterargument is that all findings are noise from the IoC extractor and code-smell rules. However, asialivewallpaper.com is a specific, non-generic domain that appears across multiple search and session-tracking URLs. This is not infrastructure noise like googleapis.com or cloudflare.com — it is the actual search destination the extension installs. The combination of explicit search redirection purpose, anonymous publisher, and session tracking URLs constitutes clear browser hijacking behavior regardless of the code-smell findings.

Key Reasons

• Extension explicitly redirects search to third-party domain asialivewallpaper.com
• Session tracking URLs detect install/uninstall events
• Anonymous Gmail publisher with no company attribution
• 30,000 users indicates successful distribution of hijacker

False Positive Considerations

• rules.map and rule.id are property access chains misread as domains
• clients2.google.com is legitimate Google update infrastructure
• postinstall_file_manipulation is code-smell YARA rule
• www.inkscape.org is legitimate software website

Reviewed 2026-05-23; recommended action: monitor; model confidence 85%.