Researchers have identified 152 Chrome extensions posing as wallpaper and new tab add-ons that are secretly distributing adware and generating fake web traffic. Spread across 38 publisher accounts and tied to three backend domains, the extensions have accumulated over 105,000 installs from the Chrome Web Store. The campaign highlights ongoing abuse of browser extension ecosystems to deliver unwanted software at scale.

Security Architect’s Take: Enforce browser extension allowlisting policies via your endpoint management platform (e.g. Chrome Enterprise or Intune) to block unapproved extensions across your organisation, and audit existing installs against the known malicious publisher accounts and domains: tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com.

Original advisory: 152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic