ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M Installs) Contains Dormant AES-GCM Browsing-History Exfiltration Pipeline to api.stanfordstudies.com
ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M (TL-2026-1289), also tracked as ModHeader spyware SDK, is a high-severity malware campaign scored CVSS 7.5, first published 2026-07-14. It has no confirmed attribution, affects ModHeader ModHeader - Modify HTTP headers (Chrome extension), maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1029), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1289
- Threat ID
- TL-2026-1289
- Also known as
- ModHeader spyware SDK, stanfordstudies exfiltration campaign
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, softwaredevelopment, cloudservices, allsectors
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
ModHeader, a legitimate developer HTTP header-modification extension with ~900,000 Chrome and ~700,000 Edge installs (1.6M combined), shipped a fully-built but allow-list-gated browsing-history collection and exfiltration pipeline in versions 7.0.17-7.0.18. The pipeline fingerprints the device, encrypts every visited domain with a hardcoded AES-GCM key, stages it in IndexedDB, and would upload it once daily on a per-device jittered schedule to api.stanfordstudies.com/app/log — while the extension also actively beaconed install/update/uninstall telemetry to extensions-hub.com. Microsoft pulled the Edge listing on 2026-07-03 and Google removed/flagged the Chrome listing as malware on 2026-07-10.
How ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M works
ModHeader (Chrome extension ID idgpnmonknjnojddfkpgkljpfnnfcklj, Edge extension ID opgbiafapkbbnbnjcdomjaghbckfkglc) is a widely-used developer tool for modifying HTTP request/response headers, with roughly 900,000 Chrome users and 700,000 Edge users. Independent reverse-engineering by researcher Yunus Aydin, UK security firm Stripe OLT, and outlet HackIndex found that the extension's background service worker (bundled in files named background-94ad634d.js / background-c2ed2c3f.js and disguised inside a file resembling the dayjs.min library) contains a complete, production-ready data-collection-and-exfiltration framework that requires no further permission grant to activate.
On install/startup, function jw() builds a per-device fingerprint (SHA-256 of Date.now().toString()) and a 12-byte random AES-GCM IV, both persisted in an IndexedDB 'settings' object store. Function Jw() hooks chrome.tabs.onUpdated to observe every URL the user navigates to; Zw() extracts the bare domain from each URL. Domains are encrypted with a hardcoded, base64-encoded AES-GCM key (aWfU3yG_wksZaQdSnxPJBOId0cAN8KK/UIlZbli7-bE) and written to a 'temp' IndexedDB object store, deduplicated with visit counters, up to a cap of 1,000 distinct domains. Function zw() computes a per-install upload delay as SHA-256(fingerprint + 'mod盐header') mod 28800, plus a fixed 25200-second offset, yielding a randomized 7-15 hour daily upload window per device — a jitter scheme designed to avoid synchronized bursts that would be conspicuous in aggregate network telemetry. Once the 1,000-domain cap or the 24-hour window is reached, Qw()/Vw() POST the encrypted domain batch plus the fingerprint and browser/user-agent metadata to https://api.stanfordstudies.com/app/log with up to 3 retries at 1-second intervals, then clear the 'temp' store to remove local evidence of the transmission.
Critically, in the analyzed 7.0.18 build the collection path is gated behind an empty client-side allow-list, so Zw() never actually fires and no domains are staged or uploaded in the observed build — researchers found no evidence of live exfiltration. However, because the entire pipeline (fingerprinting, encryption, storage, scheduling, retry logic, and evidence-clearing) already ships inside the extension, a routine update that simply populated the allow-list could silently activate mass browsing-history collection across 1.6M installs without any new permission prompt or user awareness, which is the basis for Microsoft's and Google's malware classifications.
Independently of the dormant collector, ModHeader is confirmed to actively beacon lifecycle telemetry (install, update, uninstall events with extension name, version, and browser type) to extensions-hub.com/partners/ at all times — this component is live, not gated. Infrastructure analysis found that api.stanfordstudies.com and extensions-hub.com resolve to the same AWS us-east-2-hosted IP address (3.147.61.167), suggesting shared operator infrastructure. stanfordstudies.com is a repurposed, aged domain with no actual affiliation to Stanford University, fronting an exposed OpenSearch cluster built in September 2024 that researchers assess is sized for large-scale telemetry ingestion rather than the small analytics use its branding implies.
Weak, non-definitive attribution signals noted by researchers include a Simplified Chinese browser-locale default, the embedded Unicode character '盐' (Chinese for 'salt') used as a string-obfuscation technique against static keyword searches in the jitter-seed calculation, and use of a China-origin mail provider by the domain registrant — researchers stopped short of formal group attribution. The incident is framed by multiple outlets as a 'monetization pivot': ModHeader drew user complaints in 2023 for injecting ads into search results after transitioning to an ad-supported model, consistent with a broader pattern (also referenced by Brian Krebs in 2021) of popular extensions being acquired and quietly converted into data-collection pipelines. Because ModHeader is disproportionately used by developers, QA engineers, and cloud administrators, the affected install base carries elevated exposure of internal corporate domains, VPN portals, identity-provider login pages, and cloud-console URLs versus a general consumer extension.
On 2026-07-10 (per Reddit report from u/veqtor and researcher timelines) anomalous network requests were first noticed; full reverse engineering completed 2026-07-11-07-12; Stripe OLT and Yunus Aydin published detailed technical writeups 2026-07-12-07-14. Microsoft removed the Edge listing on 2026-07-03 (ahead of public disclosure, suggesting a private vendor report), and Google removed the Chrome Web Store listing and flagged it as malware on 2026-07-10. A queried BeaconBeagle C2 configuration search for stanfordstudies.com returned zero correlated records at time of research, indicating no prior tracked malware family has been publicly linked to this specific infrastructure.
MITRE ATT&CK techniques used in TL-2026-1289
Collection
T1005 Data from Local System; T1074 Data Staged; T1185 Browser Session Hijacking; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1480 Execution Guardrails
Exfiltration
T1029 Scheduled Transfer; T1041 Exfiltration Over C2 Channel
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
persistence
Initial Access
Discovery
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts
Reconnaissance
Affected products and versions in ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M
- ModHeader — ModHeader - Modify HTTP headers (Chrome extension)
Vulnerable versions: 7.0.17; 7.0.18 - ModHeader — ModHeader - Modify HTTP headers (Microsoft Edge extension)
Vulnerable versions: 7.0.17; 7.0.18
Remediation for ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M
Patches
- No vendor patch exists; the extension has been removed from both the Chrome Web Store and Microsoft Edge Add-ons store and should not be reinstalled
Immediate actions
- Uninstall ModHeader (Chrome ID idgpnmonknjnojddfkpgkljpfnnfcklj, Edge ID opgbiafapkbbnbnjcdomjaghbckfkglc) from all managed and unmanaged browsers immediately
- Block stanfordstudies.com and extensions-hub.com at DNS/web proxy/firewall
- Block outbound HTTPS to 3.147.61.167
- Search proxy/EDR/firewall logs for POST requests to api.stanfordstudies.com/app/log and any beacons to extensions-hub.com/partners/
- Force-remove the extension via enterprise browser management policy (ExtensionInstallBlocklist / ExtensionSettings) rather than relying on user self-removal
- Delete residual on-disk artifacts: Extensions/, Local Extension Settings/, Sync Extension Settings/, Managed Extension Settings/, and the IndexedDB leveldb folder chrome-extension_idgpnmonknjnojddfkpgkljpfnnfcklj_0.indexeddb.leveldb under the Chrome/Edge profile directory
Workarounds
- If header modification is still required, migrate to an alternative extension with a transparent, audited codebase (e.g. self-hosted/open-source header-editing tools) such as VibeHeader, which was built specifically as a ModHeader replacement following this disclosure
Longer-term hardening
- Rotate any API keys, bearer tokens, or session cookies that were pasted into ModHeader's header-modification UI while it was installed
- Deploy an enterprise browser-extension governance policy (allow-list model) rather than permitting unrestricted Chrome Web Store / Edge Add-ons installs
- Monitor extension update diffs / periodically re-scan installed extensions for newly introduced network endpoints, especially for developer-tooling extensions with elevated install bases among technical staff
- Add extension-telemetry domains to a continuously updated browser-extension threat-intel blocklist
Weaknesses (CWE) in ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M
CWE-506, CWE-311, CWE-798, CWE-359
Timeline of ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M
- ModHeader draws user complaints for injecting ads into search results after apparent transition to an ad-supported model, the precursor pattern cited by researchers for the later data-collection pivot
- OpenSearch cluster backing api.stanfordstudies.com built on AWS us-east-2, sized for large-scale telemetry ingestion well ahead of public discovery
- ModHeader versions 7.0.17-7.0.18 ship the complete dormant fingerprinting, AES-GCM encryption, IndexedDB staging, jittered scheduling, and exfiltration-with-retry framework, gated behind an empty client-side allow-list
- Microsoft removes ModHeader from the Edge Add-ons store, ahead of public disclosure, consistent with a private vendor report
- Reddit user u/veqtor first notices anomalous network requests originating from ModHeader; Google removes/flags the Chrome Web Store listing as malware the same day
- Independent reverse engineering of the background service worker completed by multiple researchers, uncovering the fingerprinting, encryption, and scheduling logic
- Researcher Yunus Aydin and HackIndex publish detailed technical writeups; Chrome Web Store abuse report filed
- The Hacker News, CyberPress, GridinSoft, and VibeHeader publish follow-up analyses and cleanup guidance; VibeHeader launches as an alternative header-editing extension
- Cyber Security News and additional outlets report the incident broadly; BeaconBeagle C2 correlation query for stanfordstudies.com returns no prior tracked matches
Sources cited for ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M
- Chrome Extension Used by Million Users Caught in Data Exfiltration Scheme
- ModHeader: Covert Data Exfiltration to api.stanfordstudies.com
- Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found
- ModHeader Malware: Inside the Chrome Spyware Google Removed
- ModHeader Chrome Extension Exposes 900,000 Users to Hidden Data Exfiltration Risk
- How to Remove the ModHeader Malware (v7.0.18): Full Cleanup & Self-Check Guide
- ModHeader Flagged as Malware: Why I Built VibeHeader (Founder's Take)
- 1.6 Million combined installs famous extension ModHeader removed for Malware - Threat Radar
- ModHeader Malware Warning: Remove Extension 7.0.18
Threats related to ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M
- ClickFix Campaign Delivers TELEPUZ Modular RAT via VIDAR-Based Second Stage
- SearchJack: 23 Malicious Chrome Extensions Hijack Search Queries via chrome_settings_overrides (Yahoo Affiliate Monetization)
- EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026)
Detection coverage for TL-2026-1289
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1289 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.