Rip and Tear Doom Slayer Neon Live Wallpaper

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

This extension presents clear browser hijacking risk despite lacking traditional malware signatures. The IoC findings reveal a pattern of suspicious short domains that are characteristic of affiliate tracking and adware networks: 6t.tt, b.lt, z.de, 6v.tz, 4q.tz, s.my, θ.ly, and e.iq. These domains are not generic infrastructure or CDN domains—they are the specific type of obfuscated tracking domains used by monetization overlays. Notably, θ.ly contains a Greek theta character, a technique sometimes used to evade domain filtering.

The network finding in js/newsBar.js:17 is particularly concerning. A wallpaper extension should not contain a file named "newsBar" making fetch calls. This indicates the extension injects a news or content bar into the browser, a common monetization tactic in browser hijackers. The file name itself reveals functionality that contradicts the extension's stated purpose of providing "Doom Slayer neon wallpapers."

The developer attribution is an email address ([email protected]) rather than a verified company name, and the extension has zero users, suggesting it is either newly published or deliberately hidden. While gameograf.com appears in the IoCs and matches the developer email, this alone does not legitimize the other 521 suspicious domain findings. The benign IoCs (drive.google.com, e.target) represent known false positive patterns: drive.google.com is standard Google infrastructure, and e.target is a JavaScript property access chain misread as a domain.

The strongest counterargument is that there are no malware signatures and the code-smell findings (35 total, all low severity) are classified as noise per CVEQ guidelines. However, this verdict does not rely on malware signatures. The evidence is the behavioral pattern: an extension claiming to be a wallpaper tool that contains a newsBar.js file making network requests to 522 domains, most of which are short, random domains typical of affiliate tracking networks. This is the definition of browser hijacking—modifying browser behavior to serve monetized content without clear user consent. The absence of malware signatures does not negate the PUP/adware behavior that compromises user experience and privacy.

Key Reasons

• Multiple short affiliate tracking domains (6t.tt, b.lt, z.de, θ.ly, e.iq) indicate adware behavior
• newsBar.js file with fetch calls contradicts wallpaper extension functionality
• Anonymous publisher with zero users and email-only attribution
• 522 IoC findings concentrated in suspicious domain patterns, not generic garbage
• Category mismatch between stated purpose and actual network behavior

False Positive Considerations

• e.target property access chain misread as domain
• drive.google.com benign Google infrastructure
• code-smell findings classified as noise per guidelines
• gameograf.com matches developer email domain

Reviewed 2026-04-27; recommended action: escalate; model confidence 82%.