<ul data-eligibleForWebStory="false">18 browser extensions with over 2 million installs tracked users' online activity.Attackers exploited trust markers like install counts and user reviews to spread malware.Extensions started as legitimate utilities before injecting malicious scripts via silent updates.