Jett Valorant Gameograf

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

Extension Overview

The extension "Jett Valorant Gameograf" claims to provide Valorant-themed new tab experiences. The developer is listed as "[email protected]" with no company attribution or verified publisher status. User count is 489.

Suspicious Findings

The evidence shows 521 IoC findings, all classified as short domains extracted from the extension's files. Specific examples include XIOC-DOMAIN-q.to, XIOC-DOMAIN-r.fi, XIOC-DOMAIN-o.mv, XIOC-DOMAIN-x.ca, and XIOC-DOMAIN-eۓҧ.cv from the extracted_from_files path. This pattern of hundreds of 1-3 character domains is characteristic of browser hijackers that redirect traffic through multiple monetization endpoints.

The extension's description explicitly states it activates "every time you open a new tab," which combined with the short domain IoCs indicates new tab page replacement with monetized redirects. This is a classic browser hijacking pattern where the extension intercepts new tab requests and routes them through ad networks or affiliate landing pages.

Code-Smell Context

The 22 code-smell findings are classified as low severity and match the known false-positive patterns documented in CVEQ. These include generic JavaScript patterns that fire on almost any non-trivial code. Per the triage guidelines, code-smell findings (severity=low, finding_type=code-smell) are noise and should not drive verdicts.

Malware Signature Absence

There are zero malware signatures and zero obfuscation findings. This is consistent with PUP/browser hijacker behavior rather than traditional malware. The extension uses legitimate JavaScript but with malicious intent through domain-based redirection.

Counterargument

A skeptic might argue that short domains could be legitimate URL shorteners or tracking analytics. However, 521 short domains is an abnormally high count for any legitimate use case. Legitimate extensions with analytics use a handful of domains, not hundreds. Additionally, domains like eۓҧ.cv contain non-Latin characters, which is a red flag for typosquatting or obfuscation attempts. The combination of new tab page modification + hundreds of short domains + anonymous developer strongly indicates browser hijacking rather than legitimate functionality.

Key Reasons

• 521 short domain IoCs (q.to, r.fi, o.mv, etc.) indicate browser hijacking redirect pattern
• New tab page replacement behavior stated in extension description
• Anonymous developer ([email protected]) with no verified publisher status
• Non-Latin character domains (eۓҧ.cv, džc.ua, ջ.ca) suggest obfuscation attempts
• No malware signatures but clear monetization through domain-based redirects

False Positive Considerations

• Code-smell findings (22 total, low severity) are known noise patterns
• No obfuscation findings to indicate malicious payload hiding

Reviewed 2026-04-29; recommended action: monitor; model confidence 78%.