Black Bugatti Live Wallpaper New Tab

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

This extension, named 'Black Bugatti Live Wallpaper New Tab', presents multiple risk indicators warranting a confirmed_risk verdict.

The developer is listed as '[email protected]' - an email address rather than a proper company or developer name. This anonymous attribution is a red flag for extensions claiming to provide wallpaper functionality.

The extension contains 437 IoC findings, all medium-severity domains. Specific domains detected include ry.mx, u.sm, w.gh, v.fo, o.cd, x.im, 6.mp, k.ws, b.ck, i.na, 3.ug, and c.fr. These are all short, unusual TLDs that do not match typical wallpaper extension behavior. A legitimate wallpaper extension should not require connections to dozens of obscure domains. The XIOC-DOMAIN-ry.mx, XIOC-DOMAIN-u.sm, and XIOC-DOMAIN-w.gh findings in extracted_from_files indicate these domains are embedded in the extension code.

Additionally, 17 high-severity code-smell findings were detected. While code-smell findings are typically low-severity noise, the high severity classification here is atypical and warrants attention. The findings_summary shows "high":17, indicating these are not the benign low-severity code-smell patterns documented as false positives.

The extension's category as a 'New Tab' replacement is a known browser hijacking vector. Extensions that replace the new tab page often inject monetized content, ads, or redirect traffic to suspicious domains.

Counterargument: A skeptic would argue the 437 IoCs are XIOC extractor false positives, as the extractor is documented to produce garbage domain matches. However, the pattern of short, unusual TLDs combined with anonymous developer attribution and the new tab replacement functionality creates a consistent risk profile. If these were legitimate wallpaper assets, they would reference known image hosting services (gstatic.com, cloudflare.com) rather than obscure single-character domains.

Without malware signatures, this cannot be confirmed_malicious. However, the combination of anonymous publisher, suspicious domain pattern, and browser hijacking vector justifies confirmed_risk.

Key Reasons

• 437 IoC findings with suspicious short-domain pattern (ry.mx, u.sm, w.gh, etc.)
• Anonymous developer attribution (email address only)
• New tab replacement functionality - known browser hijacking vector
• 17 high-severity code-smell findings - atypical severity for code-smell category
• No malware signatures but consistent PUP/browser hijack indicators

False Positive Considerations

• XIOC extractor domain false positives
• Code-smell findings may be benign patterns

Reviewed 2026-04-30; recommended action: monitor; model confidence 75%.