Tracked campaign: Gameograf / Ovkas wallpaper adware

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by raw.githubusercontent.com

Chrome Web Store

Gojo Blue Eyes (Jjk) Live Wallpaper

by [email protected] · 1.0K users · 3.0 rating
c6e019bf-1f76-59c5-81f9-df1a8c36fd5e | v4.4.3
44/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
7 months ago
Version
v4.4.3
Artifact
SHA256 B55…819
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

18 detail rows

YARA Rule Matches

9 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall persistence mechanism 1
img/bg.mp4
-
LOWSQLInjection 2
script.jsjquery-3.7.1.min.js
-
LOWNoUseWeakRandom 2
script.jsjquery-3.7.1.min.js
-
LOWLocalStorageShouldNotBeUsed 1
script.js
-
LOWpostinstall crypto operations 2
_metadata/verified_contents.jsonjquery-3.7.1.min.js
-
LOWpostinstall file manipulation 3
script.jsstyle.cssjquery-3.7.1.min.js
-
LOWpostinstall obfuscation 2
img/bg.mp4jquery-3.7.1.min.js
-
LOWpostinstall network communication 3
index.htmlimg/bg.mp4jquery-3.7.1.min.js
-
LOWpostinstall system command 2
img/bg.mp4jquery-3.7.1.min.js
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

39
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
20
Portfolio

12 evidence rows available.

Finding Categories

519
IoC Indicators

YARA Rules Matched

9 rules(18 hits)
postinstall persistence mechanism SQLInjection NoUseWeakRandom LocalStorageShouldNotBeUsed postinstall crypto operations postinstall file manipulation postinstall obfuscation postinstall network communication postinstall system command

Requested Permissions

1 permission
search
Low

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality weak.

The extension 'Gojo Blue Eyes (Jjk) Live Wallpaper' (version 4.4.3) replaces the Chrome new tab page with animated content from the anime Jujutsu Kaisen. No findings were reported in categories such as malware, credential theft, or browser hijacking. The developer uses an anonymous Gmail address ([email protected]), which is a minor red flag but common for hobbyist projects. The extension's stated purpose aligns with its functionality: delivering a visual customization feature without evidence of data exfiltration, obfuscation, or suspicious network activity.

The absence of findings in critical categories (e.g., credential access, proxyware, or typosquatting) indicates no active threats. However, the extension's ability to modify the new tab page—a capability that could theoretically enable browser hijacking—warrants cautious monitoring. For example, a malicious actor could misuse similar functionality to redirect users to phishing sites, though no such behavior is observed here.

Counterargument: An anonymous developer with new tab modification rights could pose a risk. However, the lack of obfuscation, suspicious domains, or data transmission findings, combined with the extension's alignment with its stated purpose, supports a benign classification. The 596-user install base is low, reducing potential impact if risks materialize.

Recommendation: Monitor for future updates introducing obfuscation or unexpected network activity. Users should verify developer identity before trusting extensions with system-level access.

Key Reasons

  • No malicious findings in malware, credential theft, or hijacking categories
  • Extension functionality matches benign stated purpose (live wallpaper)
  • Anonymous developer lacks verification but is common for niche projects
  • Low user count limits potential harm scale

Reviewed 2026-04-23; recommended action: monitor; model confidence 70%.

About This Extension

Witness the overwhelming presence of Satoru Gojo from Jujutsu Kaisen in this striking live wallpaper. Known as the strongest sorcerer, Gojo’s iconic glowing blue eyes and limitless energy create a powerful visual moment filled with intensity and mystery. The dramatic lighting, deep shadows, and radiant blue aura highlight Gojo’s legendary power, transforming your Chrome new tab into a cinematic anime scene inspired by the world of Jujutsu Kaisen. Perfect for anime fans and JJK enthusiasts, this live wallpaper delivers a bold and immersive experience every time you open a new tab. Features 🔵 Gojo blue eyes themed anime live wallpaper ⚡ Limitless energy and glowing aura visuals 🌌 High-quality Jujutsu Kaisen anime atmosphere 🖱️ Shortcut links, date and time on the new tab 🔗 Quick access site shortcuts 🔍 It searches using the search engine selected by the user 📌 Provided more extension 🚀 Fuel Your Screen with Action-Packed Anime & High-Speed Rides! 🚀 From powerful anime sorcerers to legendary characters, Ovkas.com delivers premium live wallpapers designed to transform your Chrome new tab into an immersive visual experience. 💥 Want even more? Head to the Chrome Web Store, type "ovkas", and explore more anime, gaming, and aesthetic live wallpapers. ✨ Visit Ovkas.com and bring your digital world to life today! ✨ Google Chrome Affiliate Program Disclosure This extension, when installed, opens the ovkas.com website in your new tab to provide information about the downloaded extension. It is designed to enhance user experience, offer access to similar extensions, and help users create their own. The extension may contain links to specific services or products per policy. All redirects are designed for user benefit and require consent before any action is taken.

Frequently Asked Questions