These Chrome extensions looked harmless - but secretly stole data and hijacked accounts. Here’s what you need to know.