Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
XXXTentacion Live Wallpaper
Marketplace listing not found
Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 4 months ago
- Version
- v14.4.1
- Artifact
- SHA256 799…411
- Source
- Findings (non-IoC)
Network indicator detail is shown below
318 aggregate findings were counted. 318 network indicators contributed to the aggregate finding count.
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
Requested Permissions
1 permissionAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The XXXTentacion Live Wallpaper extension has been analyzed for potential security threats. The extension's description promises stunning live HD video wallpapers, but the findings reveal a different story. The XIOC extractor has detected multiple domains, including 猸ax3.gd, s.bz, 9.th, l.ms, ů.ba, ܚ.gm, h.gg, l.pt, a.re, c.pg, d.ky, and vg.pa. However, these domains appear to be garbage IoCs, which are a known false-positive pattern in CVEQ findings. The IoC extractor often produces false positives, especially when it comes to IPv6 fragments, loopback/link-local addresses, and property access chains misread as domains. In this case, the domains detected by XIOC do not seem to be legitimate indicators of malicious activity. Furthermore, there are no malware signatures matched, which suggests that the extension is unlikely to be malicious. A counterargument could be that the extension's developer, [email protected], is unknown, and the extension has zero users. However, this alone is not sufficient to conclude that the extension is malicious. In fact, the lack of users and the unknown developer could simply indicate that the extension is new or not well-known. Therefore, based on the findings, it is likely that this is a false positive driven by the IoC extractor's tendency to produce garbage findings.
Key Reasons
- No malware signatures matched
- IoC extractor garbage findings
- Unknown developer and zero users
False Positive Considerations
- IoC extractor garbage
Reviewed 2026-06-02; recommended action: suppress false positive; model confidence 80%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Floating Water Live Wallpaper
[email protected]
Zzz Starlight Billy Live Wallpaper
[email protected]
Guts Berserk Eclipse Grave Live Wallpaper
[email protected]
Senrai Maidens X War Thunder Live Wallpaper
[email protected]
Spider Man Minimalist HD Live Wallpaper
[email protected]
Zenitsu Yellow Demon Slayer Live Wallpaper Vsrexport
[email protected]