A threat actor is seeding the internet with AI browser extensions that can intercept a user’s authenticated session tokens and hijack accounts.