Executive Summary
Analysis of the ModHeader browser extension, which has over 1.6 million installs, reveals a sophisticated, built-in data exfiltration subsystem. The extension captures every domain a user visits, encrypts the data using a hardcoded AES-GCM key, and stores it locally in IndexedDB. This behavior is entirely independent of the extension's advertised functionality as a header modification tool.
The technical implementation includes several anti-forensic and evasion techniques, such as randomized upload timing (obfuscated with a Unicode salt), evidence deletion from local storage after successful exfiltration, and the use of a domain (api.stanfordstudies[.]com) designed to mimic legitimate academic research. The exfiltration occurs when a threshold of 1,000 unique domains is reached or 24 hours have elapsed.
This discovery represents a significant risk to organizational security, as it facilitates the collection of internal corporate domains, VPN login pages, and cloud infrastructure URLs. The similarities in tradecraft to the Foxtopia malware suggest a coordinated effort in monetizing user telemetry through browser extension supply-chain compromise.