Security researchers have uncovered a new coordinated campaign which uses malicious extensions to steal user data and hijack browsing sessions.