ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M Installs) Contains Dormant AES-GCM Browsing-History Exfiltration Pipeline to api.stanfordstudies.com — Threadlinqs Intelligence
As of 2026-07-14, ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M Installs) Contains Dormant AES-GCM Browsing-History Exfiltration Pipeline to api.stanfordstudies.com is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1289 · Severity: HIGH · CVSS: 7.5 · Status: ACTIVE · Category: MALWARE
ModHeader, a legitimate developer HTTP header-modification extension with ~900,000 Chrome and ~700,000 Edge installs (1.6M combined), shipped a fully-built but allow-list-gated browsing-history
ModHeader (Chrome extension ID idgpnmonknjnojddfkpgkljpfnnfcklj, Edge extension ID opgbiafapkbbnbnjcdomjaghbckfkglc) is a widely-used developer tool for modifying HTTP request/response headers, with roughly 900,000 Chrome users and 700,000 Edge users. Independent reverse-engineering by researcher Yunus Aydin, UK security firm Stripe OLT, and outlet HackIndex found that the extension's background service worker (bundled in files named background-94ad634d.js / background-c2ed2c3f.js and disguised inside a file resembling the dayjs.min library) contains a complete, production-ready data-collection-and-exfiltration framework that requires no further permission grant to activate.
On install/startup, function jw() builds a per-device fingerprint (SHA-256 of Date.now().toString()) and a 12-byte random AES-GCM IV, both persisted in an IndexedDB 'settings' object store. Function Jw() hooks chrome.tabs.onUpdated to observe every URL the user navigates to; Zw() extracts the bare domain from each URL. Domains are encrypted with a hardcoded, base64-encoded AES-GCM key (aWfU3yG_wksZaQdSnxPJBOId0cAN8KK/UIlZbli7-bE) and written to a 'temp' IndexedDB object store, deduplicated with visit counters, up to a cap of 1,000 distinct domains. Function zw() computes a per-install upload delay as SHA-256(fingerprint + 'mod盐header') mod 28800, plus a fixed 25200-second offset, yielding a randomized 7-15 hour daily upload window per device — a jitter scheme designed to avoid synchronized bursts that would be conspicuous in aggregate network telemetry. Once the 1,000-domain cap or the 24-hour window is reached, Qw()/Vw() POST the encrypted domain batch plus the fingerprint and browser/user-agent metadata to https://api.stanfordstudies.com/app/log with up to 3 retries at 1-second intervals, then clear the 'temp' store to remove local evidence of the transmission.
Critically, in the analyzed 7.0.18 build the collection path is gated behind an empty client-side allow-list, so Zw() never actually fires and no domains are staged or uploaded in the observed build — researchers found no evidence of live exfiltration. However, because the entire pipeline (fingerprinting, encryption, storage, scheduling, retry logic, and evidence-clearing) already ships inside the extension, a routine update that simply populated the allow-list could silently activate mass browsing-history collection across 1.6M installs without any new permission prompt or user awareness, which is the basis for Microsoft's and Google's malware classifications.
Independently of the dormant collector, ModHeader is confirmed to actively beacon lifecycle telemetry (install, update, uninstall events with extension name, version, and browser type) to extensions-hub.com/partners/ at all times — this component is live, not gated. Infrastructure analysis found that api.stanfordstudies.com and extensions-hub.com resolve to the same AWS us-east-2-hosted IP address (3.147.61.167), suggesting shared operator infrastructure. stanfordstudies.com is a repurposed, aged domain with no actual affiliation to Stanford University, fronting an exposed OpenSearch cluster built in September 2024 that researchers assess is sized for large-scale telemetry ingestion rather than the small analytics use its branding implies.
Weak, non-definitive attribution signals noted by researchers include a Simplified Chinese browser-locale default, the embedded Unicode character '盐' (Chinese for 'salt') used as a string-obfuscation technique against static keyword searches in the jitter-seed calculation, and use of a China-origin mail provider by the domain registrant — researchers stopped short of formal group attribution. The incident is framed by multiple outlets as a 'monetization pivot': ModHeader drew user complaints in 2023 for injecting ads into search results after transitioning to an ad-supported model, consistent with a broader pattern (also referenced by Brian Krebs in 2021) of popular extensions being acquired and quiet
Weaknesses (CWE)
CWE-506, CWE-311, CWE-798, CWE-359
Target sectors: technology, softwaredevelopment, cloudservices, allsectors
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195, T1176, T1176, T1027, T1070, T1480, T1518, T1005, T1185, T1560