Succubus Academy Live Wallpaper Theme

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This new tab wallpaper extension shows 188 total findings, but the evidence indicates these are overwhelmingly false positives rather than genuine security threats.

The most significant red flag is the absence of any malware signatures (0 malware-signature findings) and zero obfuscation detections. These are the two most reliable indicators of actual malicious intent. The extension's network activity shows only basic fetch calls in js/popup.js:29 and js/script.js:45, which are normal for a wallpaper extension that needs to download images.

The 185 IoC findings are almost entirely noise from the IoC extractor misreading JavaScript property access chains as domains. Examples include t.using.call, v.beforesend.call, v.global, and t.top-s.top — these are not real domains but minified code patterns that the extractor incorrectly flagged. The legitimate domains detected are api.gameograf.com (matching the developer's email domain) and videolan.org (the VLC media player website, likely referenced for codec compatibility).

The developer uses an email address ([email protected]) rather than a company name, which is somewhat generic but not inherently malicious. The extension has zero users, indicating it's either very new or very obscure. The name "Succubus Academy Live Wallpaper Theme" does not impersonate any known legitimate extension.

The strongest counterargument is that the high finding count (188) and some suspicious TLDs like .fail and .top could indicate malicious infrastructure. However, these domains appear in the context of property access chains and are not actual network destinations. Without malware signatures, obfuscation, or evidence of credential theft, browser hijacking, or data exfiltration, there is no basis for a malicious verdict. The extension's actual behavior — loading wallpapers via fetch calls — aligns with its stated purpose.

This extension should be suppressed as a false positive. The findings are driven by known IoC extractor noise patterns, not actual malicious behavior.

Key Reasons

• Zero malware signatures and zero obfuscation findings
• Most IoC findings are property access chains misread as domains
• Legitimate domains match developer email (api.gameograf.com)
• Network findings show normal fetch calls for wallpaper loading
• Extension behavior aligns with stated purpose (new tab wallpaper theme)

False Positive Considerations

• IoC extractor property access chains misread as domains (t.using.call, v.beforesend.call, v.global)
• High IoC count driven by minified code patterns, not malicious infrastructure
• Zero malware signatures and zero obfuscation findings
• Legitimate domains match developer email (api.gameograf.com)

Reviewed 2026-05-25; recommended action: suppress false positive; model confidence 85%.