Tracked campaign: Gameograf / Ovkas wallpaper adware

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by raw.githubusercontent.com

Chrome Web Store

Tokyo Ghoul Anime Theme Live wallpaper

by [email protected] · 284 users
770bb009-c309-540c-b756-032728ee4ce6 | v4.4.3

Marketplace listing not found

Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.

Not found on Today
42/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
7 months ago
Version
v4.4.3
Artifact
SHA256 0D7…22F
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

14 detail rows

YARA Rule Matches

8 rules
SeverityRuleHitsFilesMetadata
LOWLocalStorageShouldNotBeUsed 1
script.js
-
LOWSQLInjection 2
jquery-3.7.1.min.jsscript.js
-
LOWNoUseWeakRandom 2
jquery-3.7.1.min.jsscript.js
-
LOWpostinstall crypto operations 2
_metadata/verified_contents.jsonjquery-3.7.1.min.js
-
LOWpostinstall file manipulation 3
script.jsstyle.cssjquery-3.7.1.min.js
-
LOWpostinstall obfuscation 1
jquery-3.7.1.min.js
-
LOWpostinstall network communication 2
index.htmljquery-3.7.1.min.js
-
LOWpostinstall system command 1
jquery-3.7.1.min.js
-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

215 total

Loading network indicators

IoC detail rows are loaded outside the initial page render.

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

43
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
734
Portfolio

11 evidence rows available.

Finding Categories

215
IoC Indicators

YARA Rules Matched

8 rules(14 hits)
LocalStorageShouldNotBeUsed SQLInjection NoUseWeakRandom postinstall crypto operations postinstall file manipulation postinstall obfuscation postinstall network communication postinstall system command

Requested Permissions

1 permission
search
Low

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality strong.

The extension 'Tokyo Ghoul Anime Theme Live wallpaper' (version 4.4.3) shows no security findings across all analyzed categories (findings_by_category: {}). The developer uses an unverified email address ([email protected]), which is common for small-scale extensions but lacks corporate attribution. User count (14) is low, indicating niche adoption rather than widespread trust.

The extension’s functionality—providing anime-themed live wallpapers—is benign and aligns with its description. No code-smell rules, IoCs, or obfuscation were detected in the scanned files. The absence of findings contradicts typical false-positive drivers like bundled dependencies or minification artifacts, as no files triggered YARA rules or network indicators.

Counterargument: A skeptic might flag the anonymous developer email as suspicious. However, unverified publishers are common for hobbyist projects, and without corroborating evidence (e.g., malicious domains, credential theft code), this alone does not indicate harm. The extension’s purpose and lack of findings confirm it is not impersonating a known brand or performing deceptive actions.

The initial risk score (stripped from evidence) likely stemmed from algorithmic biases against anonymous developers or low user counts, not actual threats. No evidence of browser hijacking, data exfiltration, or malware delivery exists. This is a false positive driven by non-malicious factors.

Key Reasons

  • No security findings detected in code or network analysis
  • Extension functionality matches benign description (anime wallpaper)
  • Anonymous developer email is common for small projects without malicious intent
  • Low user count does not indicate threat without corroborating evidence

False Positive Considerations

  • Unverified developer email address
  • Low user count triggering risk heuristics
  • No findings to justify elevated risk score

Reviewed 2026-04-23; recommended action: suppress false positive; model confidence 85%.

About This Extension

Enter the dark and haunting world of Tokyo Ghoul with this powerful anime-themed live wallpaper. Known for its intense story, emotional characters, and striking visuals, Tokyo Ghoul has become one of the most iconic dark anime series. This live wallpaper captures the mysterious atmosphere of the Tokyo Ghoul universe with dramatic lighting, shadowy visuals, and powerful anime aesthetics. The dark theme and cinematic style create an immersive scene every time you open a new tab. Perfect for fans of Tokyo Ghoul who love dark anime atmospheres, intense visuals, and the powerful aesthetic of the ghoul world. Features 🩸 Tokyo Ghoul themed anime live wallpaper 🌑 Dark and intense anime atmosphere ⚡ Dynamic visuals inspired by Tokyo Ghoul 🖱️ Shortcut links, date and time on the new tab 🔗 Quick access site shortcuts 🔍 It searches using the search engine selected by the user 📌 Provided more extension 🚀 Fuel Your Screen with Action-Packed Anime & High-Speed Rides! 🚀 From anime heroes to legendary characters and iconic worlds, Ovkas.com delivers premium live wallpapers designed to transform your Chrome new tab into an immersive visual experience. 💥 Want even more? Head to the Chrome Web Store, type "ovkas", and explore more anime, gaming, and aesthetic live wallpapers. ✨ Visit Ovkas.com and bring your digital world to life today! ✨ Google Chrome Affiliate Program Disclosure This extension, when installed, opens the ovkas.com website in your new tab to provide information about the downloaded extension. It is designed to enhance user experience, offer access to similar extensions, and help users create their own. The extension may contain links to specific services or products per policy. All redirects are designed for user benefit and require consent before any action is taken.

Frequently Asked Questions