After five years, browser extensions turned malicious, putting countless people at risk.