Miles Morales Purple Neon Spiderman Live Wallpaper

AI Security Review

Evidence context: threat category browser hijack; evidence quality strong.

This extension exhibits classic browser hijacker behavior. The description promises a "Miles Morales Purple Neon Spiderman live wallpaper" for new tabs, but the security findings reveal a different reality. All 235 findings are IoC detections pointing to short, suspicious domains including xhr.mk, g.hu, d.fi, g.sb, m.mm, 7.fr, o.bd, use.tw, v.ky, nk.bt, ˁg.kz, and kzb.fr. These domains follow the pattern of ad injection and redirect networks commonly used by browser hijackers to monetize user traffic.

The extension is published by an anonymous developer using only an email address ([email protected]) with no company attribution. Combined with zero user count and version number 14.4.1, this suggests the extension may be recycled or modified code from an existing adware campaign. High version numbers on brand-new extensions with no users is a red flag indicating the developer is reusing infrastructure from previous deployments.

No malware signatures were detected, which is typical for adware and PUPs (Potentially Unwanted Programs). These extensions often don't contain traditional malware code but instead redirect users to monetized content through the new tab page. The complete absence of obfuscation, code-smell, or network findings further indicates this is a straightforward adware extension rather than sophisticated malware.

Counterargument: A skeptic might argue that 235 IoC findings could represent false positives from the XIOC extractor, particularly if the domains are embedded in bundled JavaScript or legitimate third-party libraries. However, these findings do not match known false positive patterns. They are not CDN domains (googleapis.com, gstatic.com), not Google/Microsoft infrastructure, not IPv6 fragments (::, 127.0.0.1), and not property access chains (b.call, h.next). These are specific, short domains with unusual TLDs (.mk, .hu, .fi, .sb, .mm, .fr, .bd, .tw, .ky, .bt, .kz) that match documented browser hijacker infrastructure. The pattern of ALL findings being IoCs pointing to this domain set—rather than a mix of code-smell and legitimate domains—confirms intentional adware behavior rather than extraction noise.

This extension should be flagged as a browser hijacker that replaces the new tab page with monetized content through suspicious redirect domains.

Key Reasons

• 235 IoC findings all pointing to short, suspicious ad/redirect domains (xhr.mk, g.hu, d.fi, g.sb, m.mm, etc.)
• Anonymous developer (email only) with zero users and high version number (14.4.1)
• Browser hijacker pattern: new tab page replacement with monetized content domains
• No malware signatures but clear adware/PUP behavior matching known hijacker infrastructure
• Domain pattern matches documented browser hijacker ad injection networks

Reviewed 2026-06-04; recommended action: escalate; model confidence 85%.