Tracked campaign: Gameograf / Ovkas wallpaper adware

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by raw.githubusercontent.com

Chrome Web Store Verified

Car lights luxury live wallpaper

by [email protected] · 360 users · 5.0 rating
66a9c667-e525-57c0-bf30-8cac8a02b33c | v2.1.1
55/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
6 days ago
Version
v2.1.1
Artifact
SHA256 D99…512
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

50 detail rows

YARA Rule Matches

10 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall persistence mechanism 1
js/background.js
-
LOWpostinstall file manipulation 14
js/countdownTimer.jsjs/calculator.jsjs/popup.js +11 more
-
LOWpostinstall crypto operations 3
js/jquery-3.7.1.min.js_metadata/verified_contents.jsonjs/script.js
-
LOWpostinstall network communication 7
js/jquery-3.7.1.min.jsimg/bg.mp4newtab.html +4 more
-
LOWpostinstall obfuscation 4
newtab.htmljs/background.jsjs/jquery-3.7.1.min.js +1 more
-
LOWpostinstall system command 2
img/bg.mp4js/jquery-3.7.1.min.js
-
LOWpostinstall file download 5
js/script.jsjs/weather.jsjs/popup.js +2 more
-
LOWSQLInjection 3
js/script.jsjs/todo.jsjs/jquery-3.7.1.min.js
-
LOWNoUseWeakRandom 2
js/createStickyNote.jsjs/jquery-3.7.1.min.js
-
LOWLocalStorageShouldNotBeUsed 3
js/script.jsjs/todo.jsjs/createStickyNote.js
-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

57 total

Loading network indicators

IoC detail rows are loaded outside the initial page render.

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

51
Noisy-finding weight
x1.00
Publisher domain
gameograf.com
Observed
Store verification signal
Limited signal
Limited
Extension portfolio
1.6K
Portfolio

11 evidence rows available.

Finding Categories

6
Network
57
IoC Indicators

YARA Rules Matched

10 rules(44 hits)
postinstall persistence mechanism postinstall file manipulation postinstall crypto operations postinstall network communication postinstall obfuscation postinstall system command postinstall file download SQLInjection NoUseWeakRandom LocalStorageShouldNotBeUsed

Requested Permissions

4 permissions
search
Low
alarms
Low
storage
Low
https://api.gameograf.com/*
Low

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality absent.

The "Car lights luxury live wallpaper" extension presents an unusual case in CVEQ triage: the findings_by_category field is completely empty ({}), indicating zero security findings across all categories. This absence of malware signatures, IoC detections, code-smell alerts, or obfuscation flags is itself significant evidence. The extension's metadata shows a straightforward purpose: the description field states it will "Transform your new tab with the mesmerizing Car Lights Luxury Live Wallpaper," which aligns with legitimate new tab customization tools. The developer_name field shows "[email protected]," an email address rather than a company name, a common pattern for smaller, independent extensions. With user_count of 338 and version "2.1.0," the extension appears to be a legitimate, actively maintained product.

The empty findings_by_category is the strongest signal here. In CVEQ's threat model, malicious extensions typically trigger multiple finding categories: malware signatures in suspicious code, IoCs for network communication, code-smell for obfuscation patterns, or impersonation indicators for typosquatting. None of these are present. The extension's name field does not mimic any well-known extension (no typosquatting of "Dark Reader," "uBlock," or similar), and the description field clearly states its wallpaper functionality without misleading claims.

A skeptic might argue that empty findings could indicate incomplete analysis rather than a clean extension. However, the metadata fields are all populated: version is "2.1.0" (not "unknown"), user_count is 338 (not zero), and a complete description exists. If the analysis hadn't run, we would expect either missing metadata or a "version": "unknown" indicator per CVEQ's incomplete_data criteria. The populated fields suggest the analysis completed successfully and found nothing concerning. Additionally, the extension's simple, declarative purpose (new tab wallpaper) doesn't require complex functionality that would typically trigger code-smell or network findings.

Given the complete absence of security findings, the legitimate-sounding functionality, and the populated metadata indicating successful analysis, this extension appears to be a false positive flag in CVEQ's system. The recommended action is no_action, as there is no evidence of malicious behavior or security risk.

Key Reasons

  • Zero security findings across all categories (findings_by_category is empty)
  • Legitimate new tab wallpaper functionality per description field
  • No typosquatting or impersonation indicators in name field
  • Populated metadata (version 2.1.0, user_count 338) indicates successful analysis

False Positive Considerations

  • Empty findings_by_category indicates no actual security concerns detected
  • Simple, legitimate new tab wallpaper functionality
  • No malware signatures or suspicious code patterns
  • Legitimate-sounding name and description

Reviewed 2026-04-26; recommended action: no action; model confidence 85%.

About This Extension

Car lights luxury live wallpaper features a dynamic HD live wallpaper designed around its visual theme, bringing the subject into every new tab with a continuously looping scene. Extension Features 🎞 Car lights luxury live wallpaper Video – Dynamic HD looped live wallpaper. 🔗 Popular Shortcuts – Quick access to YouTube, Netflix, ChatGPT, Amazon, and more. 🞞 Custom Shortcuts – Add your favorite websites for instant access. 🔍 Search Bar – Works seamlessly with your default search engine. 🕒 Clock & Date – Minimalist, always-on time & date widget. 📝 Sticky Notes – Colorful, draggable notes on your new tab. 🔔 Notifications – Get alerts about new wallpapers & features. 📧 Google Apps – One-click access to Gmail, Maps, Drive, and more. 🤖 ChatGPT Widget – Ask questions and get instant AI-powered answers. ✅ To-Do List – Organize your daily tasks directly on your new tab. 📅 Calendar Tool – Keep track of important dates. 🧮 Calculator – Perform calculations without leaving Chrome. ⏳ Timer – Built-in countdown for productivity or breaks. 🛠 More Tools – Includes privacy settings, uninstall guide, and support. About Us Gameograf.com develops premium Chrome new tab themes designed for anime, gaming, cars, celebrities, sports, and more. Enjoy visually stunning and immersive browsing experiences with every extension. 🌐 Website: https://gameograf.com 📩 Contact: https://gameograf.com/contact-us/ 🔒 Privacy Policy: https://gameograf.com/privacy-policy/ 💬 Feedback: https://gameograf.com/feedback/ 📧 Email: [email protected] Affiliate Policy Notice This extension opens a new tab at https://gameograf.com. Some links on our website including Amazon links may contain affiliate tracking. If you purchase through these links, Gameograf.com may earn a small commission, helping us maintain and improve our free extensions.

Frequently Asked Questions