Browser extensions turned malicious after years of legitimate operation in DarkSpectre campaign affecting millions. The threat group hid malware in image files.