Sung Jin Woo Shadow Apocalypse Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The available findings do not establish credential theft, browser hijacking, proxyware, or malware delivery. The listed indicators are short, mostly one-character domains such as b.se, o.ca, q.bh, and z.sr, recorded under extracted_from_files in XIOC-DOMAIN-b.se, XIOC-DOMAIN-o.ca, and XIOC-DOMAIN-q.bh. Those strings have the shape commonly produced when an extractor treats fragments of bundled or minified text as domains. No finding title identifies a login target, cookie access, search replacement, relay service, or payload delivery behavior.

The endpoint list deserves a separate check because it contains unusual names including 1b.iq, 2gr.cn, ce.support, custom.show, and cuշu1.gg. These names are not paired with network finding titles, request traces, permissions, or a source file path. The indicators XIOC-DOMAIN-hi.nz, XIOC-DOMAIN-a7.bv, and XIOC-DOMAIN-ԕ.hn also occur at extracted_from_files, which prevents a reviewer from telling whether the strings are active URLs, embedded examples, or parser output. The endpoint list alone therefore supports validation work, rather than a claim of intentional data transmission.

The extension’s stated function is a Chrome new-tab video wallpaper, and the supplied permissions list is empty. That limits the directly documented access, while the absence of a host-permission entry provides no stated authority to read pages, cookies, or browsing history. The relevant positive findings are limited to XIOC domain titles such as XIOC-DOMAIN-ǿ.be and XIOC-DOMAIN-y.ws; no title in the supplied results identifies a malware family, credential stealer, or obfuscated payload. The anonymous-looking developer address, [email protected], does not prove abuse, and the extension name does not copy a known security product.

The strongest counterargument is that custom.show, 2gr.cn, and cuշu1.gg could be real remote services used by the wallpaper. That concern remains unresolved because the supplied evidence gives no request method, URL construction site, content script path, or runtime activity for those endpoints. A runtime trace showing connections to those hosts, especially during a new-tab load, would change the assessment. Until then, the short-domain matches in XIOC-DOMAIN-b.se, XIOC-DOMAIN-o.ca, and XIOC-DOMAIN-q.bh are better treated as possible extractor noise, while the endpoint list warrants reanalysis with source locations and network capture.

Key Reasons

• XIOC-DOMAIN-b.se, XIOC-DOMAIN-o.ca, and XIOC-DOMAIN-q.bh are short extracted domains with no source file context.
• The endpoint list includes custom.show, 1b.iq, and cuշu1.gg, but no network finding ties them to an action.
• The supplied permissions list is empty, and no finding title identifies credential theft, hijacking, proxyware, or malware.
• The developer address [email protected] is not enough to establish malicious intent.

False Positive Considerations

• Short domain matches such as XIOC-DOMAIN-b.se and XIOC-DOMAIN-o.ca are recorded only at extracted_from_files.
• The indicators XIOC-DOMAIN-ǿ.be and XIOC-DOMAIN-ԕ.hn contain unusual Unicode domain text consistent with extraction artifacts.
• The endpoint list has no matching network finding title or source file path.
• The supplied permissions list is empty, limiting the documented access claimed by the extension.

Reviewed 2026-09-29; recommended action: reanalyze; model confidence 68%.