DomainTools

Chrome's auto-update default distributed the drainer once the extension changed hands

Socket says the sharpest move in this campaign was buying utilities that already had users, then shipping the payload as version two. Install-time review had already run and passed, and the 80,000-user surface came with the purchase.