Security researchers have linked three malicious browser-extension campaigns — ShadyPanda, GhostPoster and a newly disclosed cluster called DarkSpectre — to a threat actor they assess is Chinese, and say the activity has affected more than 8.8 million users over seven years. DarkSpectre alone has impacted about 2.2 million users of
