Mercedes AMG Live Wallpaper

AI Security Review

Evidence context: threat category pup; evidence quality moderate.

The Mercedes AMG Live Wallpaper extension demonstrates Potentially Unwanted Program (PUP) characteristics through its network infrastructure and developer anonymity. The extension's developer is listed only as "[email protected]" with no company attribution, which is a red flag for extensions claiming automotive branding.

The most significant finding is the presence of 406 IoC domains extracted from the extension code. These domains exhibit a highly suspicious pattern: extremely short, random-looking strings paired with various TLDs (6um.pn, z.rs, ê.am, b.cv, g.je, 4.sx, 3w.mc, x.yt, y.tm, w.kg). This pattern is inconsistent with legitimate service domains and matches known adware monetization infrastructure. Unlike legitimate extensions that reference CDN domains (googleapis.com, gstatic.com) or their own services, these domains show no legitimate business purpose.

Network analysis reveals fetch calls in js/script.js:17 and js/popup.js:35, confirming active network communication. While the fetch calls themselves are benign, combined with the suspicious domain IoCs, they indicate the extension communicates with the identified infrastructure.

The extension category (wallpaper) is commonly exploited by adware distributors. These extensions typically offer visual customization as a lure while injecting ads, tracking user behavior, or serving as adware distribution vectors. The version number (2.0) and user count (161) suggest this is an active extension, not abandoned code.

Strongest counterargument: A skeptic might argue that 406 IoC findings could be false positives from bundled dependencies or the XIOC extractor's known garbage patterns. However, this argument fails because: (1) the domains are not CDN/infrastructure domains (googleapis.com, cloudflare.com, etc.), (2) there are zero malware signatures, zero obfuscation findings, and zero code-smell findings in the obfuscation category, (3) the domain pattern is uniformly suspicious across all 406 IoCs rather than scattered legitimate domains mixed with false positives. The IoC extractor's false positive patterns involve IPv6 fragments, property access chains, and CDN domains—none of which match these findings.

The extension presents confirmed risk as a PUP/adware tool. While no traditional malware signatures are present, the infrastructure and developer anonymity indicate intentional monetization at user expense.

Key Reasons

• 406 suspicious IoC domains with random short-string patterns inconsistent with legitimate services
• Anonymous developer attribution (email only: [email protected])
• Extension category (wallpaper) commonly used for adware distribution
• Active network fetch calls in js/script.js:17 and js/popup.js:35
• No malware signatures but clear monetization infrastructure

False Positive Considerations

• None identified - IoC domains are specific and suspicious, not generic FP patterns

Reviewed 2026-05-08; recommended action: monitor; model confidence 75%.