Ken Kaneki Unleashed - Tokyo Ghoul Live Wallpaper

AI Security Review

Evidence context: threat category browser hijack; evidence quality weak.

This extension replaces the new tab page with Tokyo Ghoul video wallpaper content. The developer attribution is a raw Gmail address ([email protected]) rather than a named entity or company — common among low-quality new-tab extensions that monetize through injected search or ad links. The extension reports zero active users and has no verifiable publisher identity.

All 88 identified IoCs are XIOC-DOMAIN findings from minified JavaScript, not real domains. Strings like finish.call, r.open, t.fail, t.top-s.top, c.postdispatch.call, and v.beforesend.call are clearly property-access chains and method names extracted by the XIOC parser as false positives. However, three entries — toggle.click, custom.click, shortcut.click, and ays.tn — sit at the boundary. The .click values could plausibly be real short domains used for redirect chains (click-tracking domains are common in adware), and ays.tn is a Tunisia TLD that attackers have historically used for redirect services. None are confirmed as real domains here, but they warrant scrutiny.

The extension has zero malware signatures, zero obfuscation findings, zero code-smell flags, and zero network findings. This is unusual for a truly malicious extension — most browser hijackers or adware show at least some network or code-smell indicators. The absence of these findings, combined with the single-file extracted_from_files source for all IoCs, suggests the code base is small and straightforward: a wallpaper fetcher with a new-tab override.

The strongest counterargument for a benign verdict is that new-tab wallpaper extensions are extremely low-risk — they display content on a single page and nothing more, and the XIOC findings are classic false positives from bundled or minified JS. Many legitimate anime wallpaper extensions exist with similar profiles. However, the combination of an unverified anonymous publisher, zero users (suggesting either brand new or previously removed), and ambiguous .click / .tn strings tilts toward risk. The domain-like strings are not definitively garbage, and new-tab extensions from anonymous developers are a well-documented vector for monetized search injection.

Because the evidence does not confirm active malicious behavior but the publisher anonymity and IoC ambiguity leave meaningful risk unresolved, this extension should be flagged for ongoing monitoring rather than cleared outright.

Key Reasons

• Anonymous publisher with raw Gmail address and no verified identity
• Zero user count — no established reputation or community trust
• New-tab page replacement, a known adware/hijacker monetization vector
• Ambiguous .click and .tn strings in XIOC results warrant scrutiny despite likely being false positives
• No malware signatures or network findings to confirm or rule out malicious behavior

False Positive Considerations

• XIOC parsing minified JavaScript property chains as domains (finish.call, r.open, t.fail, etc.)
• No findings of any kind beyond ioc category despite 88 total findings
• New-tab wallpaper is a legitimate extension category without inherent risk

Reviewed 2026-06-02; recommended action: monitor; model confidence 72%.