Hackers use polymorphic browser extensions to mimic real add-ons, steal credentials, and hijack accounts. Affects Chrome, Edge, Brave, and more.