Eren Yeager Attack Titan Power Live Wallpaper

AI Security Review

Evidence context: threat category unknown malware; evidence quality moderate.

The listing describes “Eren Yeager Attack Titan Power Live Wallpaper” as a Chrome new-tab wallpaper, and the developer identity is the Gmail address [email protected]. That identity gives users no clear company or product attribution. The supplied metadata lists no declared permissions or host permissions, so the available record does not show access to browsing history, cookies, tabs, or page contents.

The main concern is the set of extracted domain indicators. The findings titled XIOC-DOMAIN-a.ch, XIOC-DOMAIN-z.no, XIOC-DOMAIN-d.lk, and XIOC-DOMAIN-pj.fo identify very short country-code domains, while the endpoint list includes custom.show, 28p.gh, 9vfwt.ai, and cozij9.pg. These names do not establish data theft by themselves, and the corresponding IoC records use the generic path extracted_from_files, so the record does not identify a JavaScript file, request, or runtime call that used them. The absence of a network finding also leaves the actual connection behavior unconfirmed.

The scan produced no malware-signature or malware finding alongside titles such as XIOC-DOMAIN-a.ch, and it produced no obfuscation finding. That reduces support for a deliberate malware verdict. The 19 low-severity code-smell results also do not establish harmful behavior because the supplied results identify no high-severity code execution, credential theft, or persistence finding. The extension's zero user count and version 1.0.2 provide little operating history, while the Chrome store listing and Gmail developer address identify the publication context without proving intent.

The strongest counterargument is that the short domains in XIOC-DOMAIN-a.ch and XIOC-DOMAIN-z.no are extraction artifacts, especially because every displayed IoC uses extracted_from_files rather than a source file. That explanation fits the lack of malware, obfuscation, and network findings. It does not resolve the separate endpoint custom.show or the cluster of unusual domains in the endpoint list, and no file-level evidence shows whether those strings are dead text, bundled media metadata, or live requests. A runtime trace or source mapping for custom.show, 28p.gh, and 9vfwt.ai would settle that question. On the current record, the findings support follow-up rather than a maliciousness claim or a clean bill of health.

Key Reasons

• The endpoint list includes unusual domains such as custom.show, 28p.gh, and 9vfwt.ai.
• IoC titles XIOC-DOMAIN-a.ch and XIOC-DOMAIN-z.no identify short domains, but their generic source path is extracted_from_files.
• No malware-signature or obfuscation finding accompanies the listed IoCs.
• The developer identity is the unattributed Gmail address [email protected], and user count is zero.

False Positive Considerations

• Short-domain IoCs such as XIOC-DOMAIN-a.ch may be extraction artifacts.
• All displayed IoCs use the generic source path extracted_from_files.
• No malware-signature or obfuscation finding is present.
• The 19 low-severity code-smell findings do not identify harmful behavior.

Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 68%.