Loading story…
Google and Microsoft removed the ModHeader browser extension from the Chrome Web Store and Edge Add-ons store after researchers found dormant code in the official signed extension that could collect users’ browsing domains and prepare them for exfiltration. Analyses of versions 7.0.17 and 7.0.18 found a built-in pipeline that extracted domains from visited URLs, encrypted them with AES-GCM, stored up to 1,000 entries locally in IndexedDB or browser storage, and staged them for upload to api.stanfordstudies[.]com/app/log. Researchers said the internal allow-list controlling the collector was empty, and they reported no evidence that browsing-domain data was actually transmitted.
The extension had an estimated 1.6 million users across Chrome and Edge and already held broad permissions, raising concern that the dormant capability could have been activated later through a routine signed update without prompting users for new access. Separate reporting said the extension also sent active telemetry for install, update, and uninstall events to extensions-hub[.]com, while a script running on every page logged request metadata locally in plaintext. Microsoft reportedly removed the Edge listing first, and Google later flagged the Chrome version as malware and pulled it, underscoring the supply-chain risk posed by trusted, high-permission browser extensions.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Stripe OLT researchers said ModHeader version 7.0.18 contained a hidden spyware SDK and assessed with low confidence that a Chinese-speaking threat actor was responsible. They cited Chinese-language strings in the code and the use of Lark-routed emails as supporting indicators.
Researchers found that the official ModHeader browser extension contained a dormant pipeline capable of collecting browsing domains, encrypting and storing them locally, and preparing them for upload to api.stanfordstudies.com. They reported that the internal allow-list was empty and found no evidence that browsing-domain data was actually exfiltrated in the analyzed builds.
Google later removed ModHeader from the Chrome Web Store and one report says it flagged the extension as malware. A source explicitly dates the Chrome listing removal to July 10.
Microsoft removed the ModHeader extension from its store after the dormant collector was discovered in the official extension. One report explicitly states the Edge listing was removed on July 3.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcestripeolt.com
Open sourceaydinnyunus.github.io
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a campaign involving **19 malicious browser extensions** distributed through the Google Chrome Web Store and Microsoft Edge Add-ons marketplace, with reported installations exceeding **2.3 million users**. Fourteen extensions were published as apparently legitimate software, while five were acquired from their original developers and later updated with malicious functionality, leaving users unaware that ownership and code had changed. The extensions contacted command-and-control infrastructure to retrieve replaceable modules, bypassed Content Security Policy controls, and injected code into targeted web pages. They could steal credentials, payment data, Facebook and LinkedIn information, browsing history, cryptocurrency assets, and hardware-wallet seed phrases; some also overlaid pages with **ClickFix** lures that impersonated browser-update notices and persuaded victims to run malicious commands, potentially extending compromise beyond the browser.
Sep 26, 2026
Microsoft has removed **119 malicious extensions** from the official Edge Add-ons store and suspended more than **90 developer accounts** linked to a coordinated operation it calls **StegoAd**. The campaign, active since at least **2021**, used browser add-ons that initially appeared legitimate before delivering malicious payloads **three to five days after installation**. Microsoft said the operation also extended to **Chrome** and **Firefox**, adapted successfully from **Manifest V2** to **Manifest V3**, and may have reached as many as **2.6 million installs**. The actor hid malicious JavaScript inside **PNG**, **WebP**, and **WOFF2** files using steganography, while relying on dormancy, fingerprinting, DevTools detection, selective payload delivery, and resilient infrastructure to evade scrutiny. Retrieved payloads enabled **arbitrary JavaScript execution**, theft of **Google credentials and second-factor codes**, harvesting of **WordPress admin logins**, bulk **cookie exfiltration** for session hijacking, and **advertising/search affiliate fraud**. Microsoft also identified more than **10 command-and-control domains**, failover mechanisms, and supporting infrastructure that included **Cloudflare Workers**, **GitHub Pages**, and covert telemetry through **Google Analytics** tracking IDs, and advised affected users to treat their browsers as exposed and rotate sensitive credentials.
Jul 1, 2026
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026