Credential theft and session hijacking

Attackers bought five working browser extensions and shipped malware through auto-update

Socket says the operators bought their way onto tens of thousands of machines and delivered the payload in a routine update. Cleanup means rotating passwords and moving crypto to fresh wallets, user by user.