A seven-year malware campaign turned trusted browser extensions into spyware, affecting 4.3 million. WeTab and other extensions remain active in Edge's store.