McLaren Cyberpunk Neon City Live Wallpaper

AI Security Review

Evidence context: threat category data exfiltration; evidence quality strong.

Threat Assessment: Confirmed Malicious

The extension "McLaren Cyberpunk Neon City Live Wallpaper" exhibits strong indicators of malicious data exfiltration or command-and-control infrastructure. The primary evidence is the presence of 833 IoC findings across multiple suspicious domains extracted from the extension's files.

Critical IoC Evidence

The XIOC-DOMAIN findings reveal a pattern of highly suspicious domains that do not match any legitimate infrastructure. Specific examples include q.et, zy.pw, u.ni, y.sy, c.nc, ϡ.my, d7.sn, q.is, r4.bh, ѥm.ps, k.sz, and i.ma. These domains share characteristics of domain generation algorithm (DGA) outputs or fast-flux networks: single or two-character subdomains, unusual TLDs (.pw, .ni, .sy, .bh, .sn, .ma, .sz, .et), and non-Latin characters in some cases (ϡ.my, ѥm.ps).

Behavioral Inconsistency

A live wallpaper extension has no legitimate technical requirement to reference 833 external domains. Legitimate wallpaper extensions typically fetch assets from a small number of CDN or hosting domains. The findings_by_category shows 833 IoC findings with 0 network findings, indicating these domains are embedded in the code rather than observed in live traffic—suggesting hardcoded C2 infrastructure or data exfiltration endpoints.

Publisher Red Flags

The developer is listed as [email protected], a generic email address with no verifiable company attribution. The extension name references McLaren (a legitimate automotive brand) without any indication of official partnership, raising typosquatting concerns.

Addressing Counterarguments

A skeptic might argue that 833 domains could be a blocklist embedded in the extension. However, the domain patterns (short alphanumeric strings with obscure TLDs) do not match known blocklist formats. Blocklists typically contain well-known malicious domains, not hundreds of single-character domains. Additionally, the findings_summary shows 0 malware-signature findings and 0 obfuscation findings, which might suggest false positives. However, the nature of the domains themselves—not the count—drives this verdict. These are not CDN domains, not Google infrastructure, not loopback addresses, and not property access chains misread as domains. They are actual domain strings that match DGA patterns.

Conclusion

The combination of 833 suspicious domain IoCs, behavioral inconsistency with wallpaper functionality, and anonymous publisher identity confirms malicious intent. The extension likely serves as a data exfiltration channel or C2 beacon disguised as a wallpaper tool.

Key Reasons

• 833 suspicious domain IoCs inconsistent with wallpaper functionality
• Domain patterns match DGA/fast-flux characteristics (q.et, zy.pw, ϡ.my, ѥm.ps)
• Anonymous developer with generic email ([email protected])
• No legitimate technical justification for hundreds of external domains
• Potential typosquatting of McLaren brand name

Reviewed 2026-04-30; recommended action: takedown request; model confidence 85%.