Analysts find five cookie-stuffing extensions, including one that’s Netflix-themed, that track victim browsing and insert rogue IDs into e-commerce sites to rack up fake affiliate payments.