Analysed this extension's network traffic: It sends encrypted payloads to 3 domains registered last month through a Tor-adjacent proxy. Classic criminal infrastructure for a crypto theft operation. DANGEROUS!