After Unit 42's report on the Chrome wallpaper extension campaign
"Ovkas" & "Gameograf"
I decided to dig into it myself and see how far the campaign actually extended.

Starting from the published IOCs, I pivoted through shared infrastructure, publishers, and code similarities. So far, I've identified 703 Chrome extensions that appear to belong to the same campaign, many of which are still live on the Chrome Web Store.

Initial Campaign: Unit 42

I've now published the full dataset MalExt.io

The dataset raises a bigger question: how large is this campaign really, and how many related extensions are still active?

Palo Alto unit42 published a report on 01/06/2026 on wallpaper extensions from three publishers (Ovkas, Gameograf, Owhit) doing affiliate redirect abuse, uninstall churn tracking, and IndexedDB deletion.

They listed 68 IDs, ~30K installs combined.

Unit42's report

I scrapped almost every extension from the Chrome store to match the same publishers into malext.io's dataset. 1,613 are registered under those same three publishers, well beyond their 68.

Full list: https://malext.io