TLDR Tech / InfoSec
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found
Google and Microsoft removed the ModHeader browser extension for Chrome and Edge after Stripe OLT found dormant code that fingerprints devices, encrypts up to 1,000 visited domains, and can post them to api.stanfordstudies[.]com on a schedule. The allow‑list that would activate collection currently ships empty, but all infrastructure and logic are in place, backed by domains tied to real hosting and ad systems. Defenders should uninstall ModHeader, rotate any secrets used with it, and block the related domains and API paths while hunting for the extension ID and matching POST traffic.
Read the full story