Home / Technology / Browser Extension Spyware Exposed!
Browser Extension Spyware Exposed!
14 Jul
Summary
- ModHeader extension secretly exfiltrated visited domains daily.
- Spyware SDK sent data to a Chinese-owned server.
- 1.6M users affected before extension removal.
A widely used browser extension, ModHeader, has been exposed for carrying malicious spyware. Security researchers discovered that version 7.0.18 included a hidden SDK designed to exfiltrate visited domain data daily. This sensitive information was reportedly sent to a server owned by Chinese entities.
The extension, which boasted over 1.6 million downloads across Google Chrome and Microsoft Edge, was subsequently removed from both respective stores. Microsoft acted on June 3, 2026, followed by Google on July 10, 2026. However, the removal from online repositories does not automatically secure devices where the extension was already installed.
Researchers attribute the operation with low confidence to a Chinese-speaking threat actor, noting the exfiltration domain's use of Lark, a communication suite common among such teams. The extension also functioned as adware, displaying ads and opening advertising tabs during updates. Defenders are urged to identify and remove existing installations to mitigate ongoing risks.
