A malicious Chrome extension service being sold by a Russian threat actor promises to bypass Google's Chrome Web Store moderation for between $2,000 and $6,000, enabling full-screen website spoofing and credential theft that security researchers say makes standard safety advice insufficient.