ModHeader version 7.0.18 contained malicious code hidden within a legitimate Chrome extension. This code included a covert SDK masquerading as the 'dayjs' date library, which harvested visited domain names and encrypted them using AES-GCM. The data was configured to be exfiltrated daily to the domain api.stanfordstudies.com. Despite the presence of a fully operational exfiltration mechanism, data collection remained inactive due to an empty allowlist. Additionally, the extension engaged in adware activity by opening affiliate tabs on every update, impacting both regular and enterprise-managed machines. The extension was distributed via the official Chrome Web Store with valid signatures, affecting users of both Chrome and Edge browsers. Forensic investigations revealed local storage of 178MB of sensitive HTTP headers from browsing activity, though no evidence of successful data exfiltration was found on analyzed systems.

The spyware component of ModHeader could have compromised user privacy by harvesting visited domain names and sensitive HTTP headers. The adware behavior caused unwanted affiliate tab openings, potentially disrupting user experience and generating fraudulent ad revenue. Although no confirmed data exfiltration occurred in analyzed cases, the presence of a fully functional exfiltration infrastructure indicates a significant risk of data leakage if activated. The malicious code's distribution through the official Chrome Web Store and valid signatures increased the risk of widespread exposure among Chrome and Edge users.

Google has removed the malicious ModHeader extension from the Chrome Web Store, effectively preventing further installations. Users should uninstall any existing installations of ModHeader version 7.0.18 or later. Since the malicious code was distributed via the official store, users should verify extensions for authenticity and monitor for suspicious behavior. No official patch or update is available; remediation involves removal of the compromised extension. Enterprise administrators should audit managed devices for the presence of this extension and remove it to prevent adware and spyware activity.