News Summary

• The cluster spans 38 separate Chrome Web Store publisher accounts and three brand backends.
• They have been collectively installed 105,000 times.
• A sub-cluster defines two hard-coded URLs in a JavaScript file that are activated during install and uninstall operations.
• The campaign is assessed to be a "financially motivated commercial adware and traffic-attribution-fraud affiliate operation," although its exact provenance remains unknown.
• The names of some of the extensions are listed below: tab plugin, yow games, chromewallpaper[.]com.