Tracked campaign: Gameograf / Ovkas wallpaper adware

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by raw.githubusercontent.com

Chrome Web Store

Anime Demon Girl Samurai Katana Live Wallpaper

by [email protected] · 200 users
91cb39c8-0eb0-5991-8a9d-66d608001084 | v4.4.3

Marketplace listing not found

Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.

Not found on Today
43/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
7 months ago
Version
v4.4.3
Artifact
SHA256 F46…A4F
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

16 detail rows

YARA Rule Matches

8 rules
SeverityRuleHitsFilesMetadata
LOWLocalStorageShouldNotBeUsed 1
script.js
-
LOWpostinstall crypto operations 2
_metadata/verified_contents.jsonjquery-3.7.1.min.js
-
LOWpostinstall file manipulation 3
script.jsstyle.cssjquery-3.7.1.min.js
-
LOWpostinstall obfuscation 1
jquery-3.7.1.min.js
-
LOWpostinstall network communication 3
img/bg.mp4index.htmljquery-3.7.1.min.js
-
LOWpostinstall system command 2
img/bg.mp4jquery-3.7.1.min.js
-
LOWSQLInjection 2
script.jsjquery-3.7.1.min.js
-
LOWNoUseWeakRandom 2
script.jsjquery-3.7.1.min.js
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

43
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
735
Portfolio

11 evidence rows available.

Finding Categories

301
IoC Indicators

YARA Rules Matched

8 rules(16 hits)
LocalStorageShouldNotBeUsed postinstall crypto operations postinstall file manipulation postinstall obfuscation postinstall network communication postinstall system command SQLInjection NoUseWeakRandom

Requested Permissions

1 permission
search
Low

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality weak.

The extension "Anime Demon Girl Samurai Katana Live Wallpaper" presents no security findings across any category. The findings_by_category bucket is completely empty, indicating no IoCs, code-smell detections, obfuscation markers, or malware signatures were identified during analysis.

The extension metadata shows a specific, non-impersonating name that does not mimic popular extensions. The description clearly states the purpose as providing anime-themed live wallpapers featuring a demon samurai character with a katana. The developer account ([email protected]) is a personal Gmail address rather than a verified company account, which is common for small, niche extensions but limits accountability. The user count of 22 indicates this is a very small extension with minimal adoption. The version number 4.4.3 suggests some development history.

Counterargument: A skeptic could argue that the empty findings bucket indicates incomplete analysis rather than clean code. If the analysis did not scan files or the data is stale, the lack of findings does not prove safety. However, the version number is specified (not 'unknown') and a UUID exists, suggesting the analysis infrastructure processed this extension. Without evidence of malicious behavior, the default position should be benign. Additionally, the extension name and description are straightforward with no indicators of typosquatting, browser hijacking, or credential theft patterns.

Assessment: This extension appears to be a legitimate, niche anime wallpaper tool with no detected security concerns. Live wallpaper extensions typically require display and potentially network permissions that could theoretically be misused, though no evidence of such misuse exists here. The personal developer account and low user count mean there is limited community scrutiny. Users should understand that while no malicious behavior is detected, the extension's capabilities could be misused in future updates if the developer account is compromised.

Key Reasons

  • No security findings detected in any category
  • Extension name and description indicate legitimate purpose
  • No typosquatting or impersonation indicators
  • Personal developer account is common for niche extensions
  • Empty findings bucket suggests clean code or limited analysis

Reviewed 2026-04-23; recommended action: no action; model confidence 60%.

About This Extension

Enter a dark and powerful anime world with the Demon Samurai Girl. Combining the elegance of a samurai warrior with the mysterious aura of a demon, this character represents strength, danger, and striking visual style. This live wallpaper captures the demon girl standing with her katana, surrounded by a dramatic atmosphere filled with shadows, glowing energy, and intense anime aesthetics. The powerful scene creates a cinematic moment every time you open a new tab. Perfect for fans of samurai themes, dark fantasy anime, and powerful warrior characters with a bold and mysterious style. Features ⚔️ Demon samurai girl themed anime live wallpaper 🔥 Dark fantasy warrior atmosphere ⚡ Dynamic visuals with glowing katana energy 🖱️ Shortcut links, date and time on the new tab 🔗 Quick access site shortcuts 🔍 It searches using the search engine selected by the user 📌 Provided more extension 🚀 Fuel Your Screen with Action-Packed Anime & High-Speed Rides! 🚀 From anime heroes to legendary warriors and iconic worlds, Ovkas.com delivers premium live wallpapers designed to transform your Chrome new tab into an immersive visual experience. 💥 Want even more? Head to the Chrome Web Store, type "ovkas", and explore more anime, gaming, and aesthetic live wallpapers. ✨ Visit Ovkas.com and bring your digital world to life today! ✨ Google Chrome Affiliate Program Disclosure This extension, when installed, opens the ovkas.com website in your new tab to provide information about the downloaded extension. It is designed to enhance user experience, offer access to similar extensions, and help users create their own. The extension may contain links to specific services or products per policy. All redirects are designed for user benefit and require consent before any action is taken.

Frequently Asked Questions