ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M Installs) Contains Dormant AES-GCM Browsing-History Exfiltration Pipeline to api.stanfordstudies.com

Key facts for ModHeader Chrome extension spyware

Detection coverage for ModHeader Chrome extension spyware

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1289 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Jittered Daily HTTPS POST to stanfordstudies.com / extensions-hub.com Shared C2 Infrastructure (C2/Exfiltration)

Detects outbound HTTPS POST traffic from a browser process to the known ModHeader exfiltration/telemetry infrastructure (api.stanfordstudies.com/app/log, extensions-hub.com/partners/, or the shared AWS IP 3.147.61.167), including the single-per-24h jittered upload pattern (7-15 hour randomized daily window) that evades fixed-schedule beacon detection.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1573.001, T1041, T1029
• Data sources: proxy_logs, firewall_logs, dns_logs, edr_network_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=firewall sourcetype IN ("squid:access", "pan:traffic", "stream:http")
(dest_host="api.stanfordstudies.com" OR dest_host="*.stanfordstudies.com" OR dest_host="extensions-hub.com" OR dest_host="*.extensions-hub.com" OR dest_ip="3.147.61.167") method=POST
| eval uri_path=coalesce(uri_path, url_path)
| where uri_path="/app/log" OR uri_path="/partners/" OR uri_path LIKE "%partners%"
| bin _time span=1d
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_host) as dest_host by src_ip, user, uri_path
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table src_ip, user, dest_host, uri_path, count, first_seen, last_seen

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("stanfordstudies.com", "extensions-hub.com") or RemoteIP == "3.147.61.167"
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| summarize ConnectionCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| order by LastSeen desc

Sigma

title: Outbound HTTPS POST to ModHeader stanfordstudies/extensions-hub C2 Infrastructure
id: 1289a1c3-0003-4a2b-9c3d-tl20261289003
status: experimental
description: Detects outbound network connections from a browser process to the known ModHeader exfiltration endpoint (api.stanfordstudies.com), lifecycle-beacon endpoint (extensions-hub.com), or the shared AWS-hosted destination IP 3.147.61.167.
references:
    - https://cybersecuritynews.com/chrome-extension-used-million-users-data-exfiltration/
    - https://radar.offseq.com/threat/16-million-combined-installs-famous-extension-modh-b12ce9577a362d5d
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/14
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1573.001
    - attack.exfiltration
    - attack.t1041
    - attack.t1029
logsource:
    category: network_connection
    product: any
detection:
    selection:
        DestinationHostname|endswith:
            - 'stanfordstudies.com'
            - 'extensions-hub.com'
        Initiated: true
    selection_ip:
        DestinationIp: '3.147.61.167'
    condition: selection or selection_ip
falsepositives:
    - None expected; these are threat-specific IOC domains/IP with no legitimate business use
level: critical

Known false positives:

• None expected; these are threat-specific IOC domains/IP with no legitimate business use

Tuning notes: Immediately blocklist these domains/IP at DNS and proxy rather than relying solely on detection; keep the rule active post-blocklisting to catch any devices bypassing the proxy.

• 🔒 ModHeader Extension Install/Update via Chrome/Edge Management Telemetry (Exploitation - Supply Chain) · unlock with TL Creds
• 🔒 Device Fingerprinting and AES Key Material Persisted in Extension IndexedDB Settings Store (Post-Exploitation - Collection) · unlock with TL Creds
• 🔒 Browser Process Beaconing to Shared AWS-Hosted C2 Infrastructure with Encrypted Payload Retry Pattern (C2/Exfiltration) · unlock with TL Creds
• 🔒 Chrome/Edge Software Inventory Discovery of Flagged ModHeader Extension IDs (Exploitation - Discovery/Supply Chain) · unlock with TL Creds
• 🔒 Browsing Domains Staged and Deduplicated in Extension Temp Store with Visit-Count Encryption Pattern (Post-Exploitation - Collection/Archival) · unlock with TL Creds
• 🔒 DNS Resolution Correlating Repurposed Domain and Telemetry Domain to Shared Infrastructure with Unicode-Obfuscated Seed String (C2/Lateral - Infrastructure Correlation) · unlock with TL Creds
• 🔒 ModHeader Malicious Extension Install/Update Detected (Exploitation - Supply Chain) · unlock with TL Creds
• 🔒 Browser Extension IndexedDB Fingerprint/Key Staging and Stage-Then-Clear Evidence Removal (Post-Exploitation - Collection) · unlock with TL Creds

Indicators of compromise for ModHeader Chrome extension spyware

As of 2026-07-14, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-1289.

Sample indicators (3 of 17)

• IP address: 3.147.61[.]167
• Domain: stanfordstudies[.]com
• Domain: extensions-hub[.]com

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How ModHeader Chrome extension spyware works

Microsoft pulled the Edge listing on 2026-07-03 and Google removed/flagged the Chrome listing as malware on 2026-07-10.

ModHeader (Chrome extension ID idgpnmonknjnojddfkpgkljpfnnfcklj, Edge extension ID opgbiafapkbbnbnjcdomjaghbckfkglc) is a widely-used developer tool for modifying HTTP request/response headers, with roughly 900,000 Chrome users and 700,000 Edge users. Independent reverse-engineering by researcher Yunus Aydin, UK security firm Stripe OLT, and outlet HackIndex found that the extension's background service worker (bundled in files named background-94ad634d.js / background-c2ed2c3f.js and disguised inside a file resembling the dayjs.min library) contains a complete, production-ready data-collection-and-exfiltration framework that requires no further permission grant to activate.

On install/startup, function jw() builds a per-device fingerprint (SHA-256 of Date.now().toString()) and a 12-byte random AES-GCM IV, both persisted in an IndexedDB 'settings' object store. Function Jw() hooks chrome.tabs.onUpdated to observe every URL the user navigates to; Zw() extracts the bare domain from each URL. Domains are encrypted with a hardcoded, base64-encoded AES-GCM key (aWfU3yG_wksZaQdSnxPJBOId0cAN8KK/UIlZbli7-bE) and written to a 'temp' IndexedDB object store, deduplicated with visit counters, up to a cap of 1,000 distinct domains. Function zw() computes a per-install upload delay as SHA-256(fingerprint + 'mod盐header') mod 28800, plus a fixed 25200-second offset, yielding a randomized 7-15 hour daily upload window per device — a jitter scheme designed to avoid synchronized bursts that would be conspicuous in aggregate network telemetry. Once the 1,000-domain cap or the 24-hour window is reached, Qw()/Vw() POST the encrypted domain batch plus the fingerprint and browser/user-agent metadata to https://api.stanfordstudies.com/app/log with up to 3 retries at 1-second intervals, then clear the 'temp' store to remove local evidence of the transmission.

Critically, in the analyzed 7.0.18 build the collection path is gated behind an empty client-side allow-list, so Zw() never actually fires and no domains are staged or uploaded in the observed build — researchers found no evidence of live exfiltration. However, because the entire pipeline (fingerprinting, encryption, storage, scheduling, retry logic, and evidence-clearing) already ships inside the extension, a routine update that simply populated the allow-list could silently activate mass browsing-history collection across 1.6M installs without any new permission prompt or user awareness, which is the basis for Microsoft's and Google's malware classifications.

Independently of the dormant collector, ModHeader is confirmed to actively beacon lifecycle telemetry (install, update, uninstall events with extension name, version, and browser type) to extensions-hub.com/partners/ at all times — this component is live, not gated. Infrastructure analysis found that api.stanfordstudies.com and extensions-hub.com resolve to the same AWS us-east-2-hosted IP address (3.147.61.167), suggesting shared operator infrastructure. stanfordstudies.com is a repurposed, aged domain with no actual affiliation to Stanford University, fronting an exposed OpenSearch cluster built in September 2024 that researchers assess is sized for large-scale telemetry ingestion rather than the small analytics use its branding implies.

Weak, non-definitive attribution signals noted by researchers include a Simplified Chinese browser-locale default, the embedded Unicode character '盐' (Chinese for 'salt') used as a string-obfuscation technique against static keyword searches in the jitter-seed calculation, and use of a China-origin mail provider by the domain registrant — researchers stopped short of formal group attribution. The incident is framed by multiple outlets as a 'monetization pivot': ModHeader drew user complaints in 2023 for injecting ads into search results after transitioning to an ad-supported model, consistent with a broader pattern (also referenced by Brian Krebs in 2021) of popular extensions being acquired and quietly converted into data-collection pipelines. Because ModHeader is disproportionately used by developers, QA engineers, and cloud administrators, the affected install base carries elevated exposure of internal corporate domains, VPN portals, identity-provider login pages, and cloud-console URLs versus a general consumer extension.

On 2026-07-10 (per Reddit report from u/veqtor and researcher timelines) anomalous network requests were first noticed; full reverse engineering completed 2026-07-11-07-12; Stripe OLT and Yunus Aydin published detailed technical writeups 2026-07-12-07-14. Microsoft removed the Edge listing on 2026-07-03 (ahead of public disclosure, suggesting a private vendor report), and Google removed the Chrome Web Store listing and flagged it as malware on 2026-07-10. A queried BeaconBeagle C2 configuration search for stanfordstudies.com returned zero correlated records at time of research, indicating no prior tracked malware family has been publicly linked to this specific infrastructure.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1074 Data Staged; T1185 Browser Session Hijacking; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1480 Execution Guardrails

Exfiltration

T1029 Scheduled Transfer; T1041 Exfiltration Over C2 Channel

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

persistence

T1176 Software Extensions

Initial Access

T1195 Supply Chain Compromise

Discovery

T1518 Software Discovery

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts

Reconnaissance

T1592 Gather Victim Host Information

Remediation for ModHeader Chrome extension spyware

Patches

• No vendor patch exists; the extension has been removed from both the Chrome Web Store and Microsoft Edge Add-ons store and should not be reinstalled

Immediate actions

• Uninstall ModHeader (Chrome ID idgpnmonknjnojddfkpgkljpfnnfcklj, Edge ID opgbiafapkbbnbnjcdomjaghbckfkglc) from all managed and unmanaged browsers immediately
• Block stanfordstudies.com and extensions-hub.com at DNS/web proxy/firewall
• Block outbound HTTPS to 3.147.61.167
• Search proxy/EDR/firewall logs for POST requests to api.stanfordstudies.com/app/log and any beacons to extensions-hub.com/partners/
• Force-remove the extension via enterprise browser management policy (ExtensionInstallBlocklist / ExtensionSettings) rather than relying on user self-removal
• Delete residual on-disk artifacts: Extensions/, Local Extension Settings/, Sync Extension Settings/, Managed Extension Settings/, and the IndexedDB leveldb folder chrome-extension_idgpnmonknjnojddfkpgkljpfnnfcklj_0.indexeddb.leveldb under the Chrome/Edge profile directory

Workarounds

• If header modification is still required, migrate to an alternative extension with a transparent, audited codebase (e.g. self-hosted/open-source header-editing tools) such as VibeHeader, which was built specifically as a ModHeader replacement following this disclosure

Longer-term hardening

• Rotate any API keys, bearer tokens, or session cookies that were pasted into ModHeader's header-modification UI while it was installed
• Deploy an enterprise browser-extension governance policy (allow-list model) rather than permitting unrestricted Chrome Web Store / Edge Add-ons installs
• Monitor extension update diffs / periodically re-scan installed extensions for newly introduced network endpoints, especially for developer-tooling extensions with elevated install bases among technical staff
• Add extension-telemetry domains to a continuously updated browser-extension threat-intel blocklist

Affected and fixed versions

• ModHeader — ModHeader - Modify HTTP headers (Chrome extension)
  Vulnerable versions: 7.0.17; 7.0.18
• ModHeader — ModHeader - Modify HTTP headers (Microsoft Edge extension)
  Vulnerable versions: 7.0.17; 7.0.18

Timeline of ModHeader Chrome extension spyware

• 2023-01-01 locked-ioc-17 draws user complaints for injecting ads into search results after apparent transition to an ad-supported model, the precursor pattern cited by researchers for the later data-collection pivot
• 2024-09-01 OpenSearch cluster backing locked-ioc-11 built on AWS us-east-2, sized for large-scale telemetry ingestion well ahead of public discovery
• 2026-06-01 locked-ioc-17 versions 7.0.17-7.0.18 ship the complete dormant fingerprinting, AES-GCM encryption, IndexedDB staging, jittered scheduling, and exfiltration-with-retry framework, gated behind an empty client-side allow-list
• 2026-07-03 Microsoft removes locked-ioc-17 from the Edge Add-ons store, ahead of public disclosure, consistent with a private vendor report
• 2026-07-10 Reddit user u/veqtor first notices anomalous network requests originating from locked-ioc-17; Google removes/flags the Chrome Web Store listing as malware the same day
• 2026-07-11 Independent reverse engineering of the background service worker completed by multiple researchers, uncovering the fingerprinting, encryption, and scheduling logic
• 2026-07-12 Researcher Yunus Aydin and HackIndex publish detailed technical writeups; Chrome Web Store abuse report filed
• 2026-07-13 The Hacker News, CyberPress, GridinSoft, and VibeHeader publish follow-up analyses and cleanup guidance; VibeHeader launches as an alternative header-editing extension
• 2026-07-14 Cyber Security News and additional outlets report the incident broadly; BeaconBeagle C2 correlation query for locked-ioc-14 returns no prior tracked matches

Sources cited for ModHeader Chrome extension spyware

• ModHeader: Covert Data Exfiltration to api.stanfordstudies.com aydinnyunus.github.io · Research · 2026-07-12
• ModHeader Malware: Inside the Chrome Spyware Google Removed hackindex.io · Research · 2026-07-12
• 1.6 Million combined installs famous extension ModHeader removed for Malware - Threat Radar radar.offseq.com · Research · 2026-07-14
• How to Remove the ModHeader Malware (v7.0.18): Full Cleanup & Self-Check Guide vibeheader.com · Blog · 2026-07-13
• ModHeader Flagged as Malware: Why I Built VibeHeader (Founder's Take) vibeheader.com · Blog · 2026-07-13
• ModHeader Malware Warning: Remove Extension 7.0.18 blog.gridinsoft.com · Blog · 2026-07-13
• Chrome Extension Used by Million Users Caught in Data Exfiltration Scheme cybersecuritynews.com · News · 2026-07-14
• Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found The Hacker News · News · 2026-07-13
• ModHeader Chrome Extension Exposes 900,000 Users to Hidden Data Exfiltration Risk cyberpress.org · News · 2026-07-14

Threats related to ModHeader Chrome extension spyware

• ClickFix Campaign Delivers TELEPUZ Modular RAT via VIDAR-Based Second Stage
• SearchJack: 23 Malicious Chrome Extensions Hijack Search Queries via chrome_settings_overrides (Yahoo Affiliate Monetization)
• EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026)

Previous and next in malware

• Operation Capsule Vault: APT37 Weaponizes Real Academic Event Materials to Deliver RokRAT via ISO/Process Injection Previous report
• SolidPDFCreator: Mustang Panda Stage-1 Backdoor Targeting India via DLL Side-Loading Next report