HI-MA-2026-001 High Published Malware
Hidden spyware and adware in the ModHeader browser extension
ModHeader, a developer tool with more than 800,000 users on Chrome, shipped a hidden spyware SDK in version 7.0.18. The code collects the domains you visit, encrypts them and sends them once a day to api.stanfordstudies.com. In this build the collector was still switched off, but the endpoint, key and schedule were all present. On top of that the extension opened an ad tab on every update, also on managed company machines. Google and Microsoft removed the extension from their stores.
What it does
- Collects the host name of every page you visit, with how often you visit it
- Encrypts that list and sends it once a day to api.stanfordstudies.com, at a time that differs per install
- Hides its helpers in a file posing as the dayjs date library
- Was still switched off in this build: an empty list of browsers held the collector back, an update could turn it on
- Opens an ad tab on every update, also on managed company machines
- Keeps the full request and response headers of all your traffic locally, including tokens and session cookies
- Affects the official listing on Chrome (more than 800,000 users) and Edge, not Firefox
What to do
Check that your browser disabled the extension. Chrome and Edge usually do this themselves. Delete the leftover folders of the extension: Extensions, IndexedDB, Local, Sync and Managed Extension Settings with the extension ID. Block and log DNS traffic to api.stanfordstudies.com. Revoke tokens and sessions that may be in the stored headers. Only install a header tool from a source you trust.
Indicators
To look up or block in your own environment.
| Extension ID | idgpnmonknjnojddfkpgkljpfnnfcklj (Chrome) |
|---|---|
| Extension ID | opgbiafapkbbnbnjcdomjaghbckfkglc (Edge) |
| Versions | 7.0.18 |
| Domain | api.stanfordstudies[.]com |
| URL | hxxps://api.stanfordstudies[.]com/app/log |
| Domain | www.extensions-hub[.]com |
| IP address | 3.147.61[.]167 |
| File | assets/src/background-94ad634d.js |
| File | assets/dayjs.min-6a736ee8.js |
Timeline
- Version 7.0.18 appears in the Chrome Web Store
- Microsoft removes the extension from Edge Add-ons 2 days
- Technical analysis published 11 days
References
About this report
HackIndex does pentests and code review, and researches open-source packages, plugins and extensions. A vulnerability goes to the maker first, malware straight to the platform that spreads it.
Questions about this report or a correction? Mail info [at] hackindex [dot] nl with HI‑MA‑2026‑001 in the subject.
You may reuse this report under CC BY 4.0 (opens in a new tab), with the reference and this URL as source.
Why HackIndex does research Deadlines and agreements About HackIndex
Have it checked
Malicious extensions often reach a team through one developer. A code review shows what your app and tooling load and send.