# Hidden spyware and adware in the ModHeader browser extension

- **Reference**: HI-MA-2026-001
- **Type**: Malware
- **Severity**: High
- **Platform**: Chrome Web Store en Edge Add-ons
- **Extension or package**: ModHeader - Modify HTTP headers
- **Affected versions**: 7.0.18
- **Researched by**: [Joshua van der Poll](https://hackindex.nl/en/author/joshua-van-der-poll)

ModHeader, a developer tool with more than 800,000 users on Chrome, shipped a hidden spyware SDK in version 7.0.18. The code collects the domains you visit, encrypts them and sends them once a day to api.stanfordstudies.com. In this build the collector was still switched off, but the endpoint, key and schedule were all present. On top of that the extension opened an ad tab on every update, also on managed company machines. Google and Microsoft removed the extension from their stores.

## What it does

- Collects the host name of every page you visit, with how often you visit it
- Encrypts that list and sends it once a day to api.stanfordstudies.com, at a time that differs per install
- Hides its helpers in a file posing as the dayjs date library
- Was still switched off in this build: an empty list of browsers held the collector back, an update could turn it on
- Opens an ad tab on every update, also on managed company machines
- Keeps the full request and response headers of all your traffic locally, including tokens and session cookies
- Affects the official listing on Chrome (more than 800,000 users) and Edge, not Firefox

## What to do

Check that your browser disabled the extension. Chrome and Edge usually do this themselves.
Delete the leftover folders of the extension: Extensions, IndexedDB, Local, Sync and Managed Extension Settings with the extension ID.
Block and log DNS traffic to api.stanfordstudies.com.
Revoke tokens and sessions that may be in the stored headers.
Only install a header tool from a source you trust.

## Indicators

- Extension ID: `idgpnmonknjnojddfkpgkljpfnnfcklj (Chrome)`
- Extension ID: `opgbiafapkbbnbnjcdomjaghbckfkglc (Edge)`
- Versions: `7.0.18`
- Domain: `api.stanfordstudies[.]com`
- URL: `hxxps://api.stanfordstudies[.]com/app/log`
- Domain: `www.extensions-hub[.]com`
- IP address: `3.147.61[.]167`
- File: `assets/src/background-94ad634d.js`
- File: `assets/dayjs.min-6a736ee8.js`

## Timeline

- 2026-07-01: Version 7.0.18 appears in the Chrome Web Store
- 2026-07-03: Microsoft removes the extension from Edge Add-ons
- 2026-07-12: Technical analysis published

## References

- [Technisch rapport: ModHeader Malware](https://hackindex.io/research/modheader-malware-chrome-spyware)
- [The Hacker News: Google en Microsoft halen ModHeader weg](https://thehackernews.com/2026/07/google-and-microsoft-pull-modheader.html)

## About this report

HackIndex does pentests and code review, and researches open-source packages, plugins and extensions. A vulnerability goes to the maker first, malware straight to the platform that spreads it.

Questions about this report or a correction? Mail the address in security.txt with HI-MA-2026-001 in the subject.

You may reuse this report under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), with the reference and this URL as source.

- [Why HackIndex does research](https://hackindex.nl/en/research)
- [Deadlines and agreements](https://hackindex.nl/en/security)
- [security.txt](https://hackindex.nl/.well-known/security.txt)

Source: https://hackindex.nl/en/research/hi-ma-2026-001