In a unique attack, cybercriminals locally install an extension to manipulate data in internal web applications that the victims have access to.
Source: Threadpost