Gameograf and Ovkas Wallpaper Extensions Push Affiliate Traffic and Remote Popups

Overview

Palo Alto Networks Unit 42 reported on 1 June 2026 that three Chrome publishing accounts, Ovkas, Gameograf and Kidswallpapers/Owhit, run more than 50 live-wallpaper extensions as adware. This entry lists 608 wallpaper and new-tab extensions, about 254,000 installs in total, whose code calls gameograf.com. The largest are "Sung Jinwoo Solo Leveling" (8,000 installs) and "Marvel Spider Man Live Wallpaper" (6,000). Half have fewer than 180 installs: many near-identical listings, each small.

We checked a sample of builds by hand. Every one names Gameograf as its manifest author, opens an affiliate page on install and registers an uninstall URL. The remote popups and the IndexedDB deletion appear in some builds, not all. 242 of the first 409 we listed also reference ovkas.com, which matches Unit 42's finding that Ovkas and Gameograf share one operator.

How it works

• Forced affiliate traffic. A chrome.runtime.onInstalled listener opens an affiliate-tracked page, such as https://gameograf.com/?utm_source=ovkas&..., without the user asking. The operator earns from traffic the user never chose.
• Uninstall tracking. chrome.runtime.setUninstallURL() reports each removal to the operator, for churn tracking and retargeting.
• Remote popups and links. Newer builds fetch https://api.gameograf.com/popup/message.json and https://api.gameograf.com/js/shortcuts.json and write the result into the page as HTML. The operator can change what users see at any time, with no store update.
• IndexedDB deletion. Some builds call indexedDB.deleteDatabase. Unit 42 notes that this clears data other web apps keep in the browser, including offline data.

The listings show an affiliate disclosure. Unit 42 notes that the privacy policy does not cover the forced redirects, uninstall tracking, link injection or IndexedDB deletion.

Attribution notes

Unit 42 assesses Ovkas and Gameograf as very likely the same operator: same manifest author, same redirect destination, same affiliate infrastructure and identical code templates. It assesses Kidswallpapers/Owhit as a likely separate operator using a similar template, and links Owhit to an earlier campaign of adware cursor extensions. It also found signs that the extensions were written with an AI coding agent. The extensions listed here were tied to the campaign by their own code calling the Gameograf domain. A small number had not been analysed when this was written and are not listed.

How to spot it

• A wallpaper or "new tab" extension that opens a page you did not ask for right after install.
• Network requests from the extension to gameograf.com, api.gameograf.com or ovkas.com.
• Remove any extension listed here. Administrators can block the IDs above and the domains in the IOC list.