Black BMW M760 Live Wallpaper

AI Security Review

Evidence context: threat category pup; evidence quality moderate.

The 'Black BMW M760 Live Wallpaper' extension demonstrates Potentially Unwanted Program (PUP) characteristics through its monetization infrastructure. The evidence shows 487 IoC findings consisting of short, random domain names including f.tm, 8.nz, s.bi, oho.bv, a1ʴ.nr, a.aq, c.li, l.bm, q.hr, x.cm, n.kz, and ǟ.ie. These domains are characteristic of URL shorteners and affiliate/ad networks, not legitimate service infrastructure. The extension description claims to provide live wallpapers, but the domain pattern indicates aggressive monetization through redirects or ad injection.

The developer attribution is opaque: only an email address ([email protected]) is provided with no company name, website, or verified publisher identity. Combined with 605 users and no transparency about data practices, this matches the PUP profile of monetization-focused extensions without clear accountability.

Importantly, the findings show 0 malware signatures, 0 malware findings, and 0 obfuscation detections. The 22 code-smell findings are low-severity noise per CVEQ's known false-positive patterns. The 2 network findings are minimal and do not indicate credential theft or session hijacking. This is not a confirmed malicious extension—it does not steal data, install malware, or hijack browser settings.

Counterargument: A skeptic might argue this is a legitimate free wallpaper extension that uses standard ad monetization. Many legitimate extensions monetize through ads. However, the domain pattern here is not standard ad network infrastructure (like Google AdSense or DoubleClick). The 487 short/random domains indicate a more aggressive, opaque monetization scheme typical of PUPs that redirect users through affiliate chains. The lack of developer transparency and the volume of monetization domains exceeds what legitimate extensions typically require. This is not malware, but users should be aware they are installing software designed primarily for monetization rather than user value.

Key Reasons

• 487 IoC findings are short/random domains (f.tm, 8.nz, s.bi) characteristic of affiliate/ad networks, not legitimate services
• Developer attribution is email-only ([email protected]) with no company identity or website
• 0 malware signatures and 0 obfuscation findings rule out confirmed malicious intent
• Extension category (wallpaper) with aggressive monetization infrastructure matches PUP profile
• Low user count (605) combined with opaque monetization indicates limited trustworthiness

False Positive Considerations

• 22 code-smell findings are low-severity noise per CVEQ guidelines
• IoC count (487) is inflated by bundled monetization domains, not malware

Reviewed 2026-04-30; recommended action: monitor; model confidence 75%.