BMW Cursor 999

AI Security Review

Evidence context: threat category none; evidence quality moderate.

BMW Cursor 999 is a Chrome extension that swaps the browser pointer for BMW-themed cursor images. It declares no permissions and no host permissions, so it cannot read cookies, observe tabs, or inject script into pages. The only capability visible in the code is outbound HTTP fetching.

Three medium-severity network findings sit in two files: NET-FETCH-lib/catalog.js-45 and NET-FETCH-lib/catalog.js-131, plus NET-FETCH-lib/render.js-45. A cursor extension needs a list of cursor images and a renderer that applies the chosen one, so fetch calls in lib/catalog.js and lib/render.js are the expected shape of that code. The finding titles record the file and line only, with no destination host, so the scan does not say which server these requests reach.

The 33 indicator-of-compromise entries are the part of this result that looks alarming and is not. The list includes 3lg.ug, 5r.kr, bi.ae, ei.hr, gu.sg, ihc.nr and jr.tz, all six-character strings built from a digit, two letters and a two-letter country code. Three carry letters that are not in the English alphabet at all: nj.cl, ɳ.me and ԃ.vu. Nobody registers those. They are substrings the extractor lifted out of compressed JavaScript and reshaped into something domain-shaped. The one entry that reads like a real host is gameograf.com, which fits an asset or catalog server for cursor artwork.

Sixteen code-smell findings round out the count. These are generic rules that fire on ordinary JavaScript: string handling, timing calls, variable access. None of them describe behavior specific to this extension.

A skeptic would point at the publisher. The developer name is [email protected], a personal Gmail address, and the listing carries BMW's trademark with no corporate attribution. The install count is zero. A cursor extension with a remote fetch and an anonymous author is the profile that often turns out to be adware once it finds an audience.

That reading does not survive the rest of the evidence. Adware needs permissions to redirect searches, replace the new tab page or inject script, and this manifest requests none of them. Obfuscation findings are zero, malware signatures are zero, and nothing in the scan shows user data leaving the browser. What would settle the open question is the literal request URL inside lib/catalog.js:45 and lib/render.js:45. If those point at a cursor image catalog on gameograf.com, this is a small theming extension and nothing more. If they point somewhere unrelated to cursors, the picture changes.

Key Reasons

• Manifest declares no permissions and no host permissions, ruling out cookie, tab or script-injection abuse
• Three NET-FETCH findings in lib/catalog.js and lib/render.js match the code a cursor theme needs to load and apply artwork
• The bulk of the 33 IoC entries are six-character fragments (5r.kr, bi.ae) and non-ASCII strings (nj.cl, ɳ.me, ԃ.vu) that are not registrable domains
• Zero malware signatures and zero obfuscation findings across 52 total findings
• gameograf.com is the only plausible host in the endpoint list and fits an asset server for cursor images

False Positive Considerations

• IoC extractor fragmentation of minified JavaScript into domain-shaped substrings, including non-ASCII fragments nj.cl, ɳ.me and ԃ.vu
• 16 code-smell matches from generic YARA rules that fire on ordinary JavaScript string and timing code
• Network findings recorded only as file and line, producing endpoint lists that mix real hosts with substring noise

Reviewed 2026-10-28; recommended action: suppress false positive; model confidence 72%.