Avengers Endgame Thor Live Wallpaper

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

This extension presents a clear adware risk based on its network indicators. The extension is named "Avengers Endgame Thor Live Wallpaper" and claims to provide dynamic wallpapers, but the code contains multiple suspicious domains that contradict this stated purpose. The IoC findings reveal click-tracking domains including trigger.click, custom.click, and toggle.click, which are characteristic of affiliate marketing and ad injection rather than wallpaper delivery. Additionally, short domains like ce.now, e.now, u.mk, bg.mp, and ke.td appear in the codebase, which are commonly used for ad redirects and tracking.

The developer identity is concerning: [email protected] is a generic Gmail address with no company attribution, which is atypical for legitimate commercial extensions. The user count of 0 combined with version 14.4.1 is suspicious—a high version number with no users suggests either recycled versioning or the extension has been repurposed. The legitimate domains in the findings (fonts.gstatic.com, www.instagram.com, www.netflix.com) could be false positives from the IoC extractor or legitimate references, but they do not explain the presence of multiple click-tracking domains.

Importantly, there are zero malware signatures, zero obfuscation findings, and zero code-smell findings. This distinguishes the extension from confirmed malware. The absence of obfuscation means the click-tracking domains are not hidden, suggesting this is a known monetization strategy rather than stealthy malicious behavior. The extension likely injects ads, affiliate links, or tracking pixels into the browser, which qualifies as Potentially Unwanted Program (PUP) behavior.

The strongest counterargument is that these domains could be bundled dependencies or false positives from the IoC extractor. However, click-tracking domains like trigger.click and custom.click are not standard library dependencies—they are actively used for monetization. Legitimate wallpaper extensions do not require affiliate tracking infrastructure. The pattern of multiple .click domains specifically points to adware behavior, not false positives.

Key Reasons

• Multiple click-tracking domains (trigger.click, custom.click, toggle.click) inconsistent with wallpaper functionality
• Short redirect domains (ce.now, e.now, u.mk, bg.mp) commonly used for ad injection
• Email-only developer with no company attribution
• Zero users with high version number (14.4.1) suggests suspicious versioning

False Positive Considerations

• Legitimate domains (fonts.gstatic.com, instagram.com, netflix.com) likely false positives
• Property access chains misread as domains (t.using.call)

Reviewed 2026-06-05; recommended action: monitor; model confidence 75%.