To make sure the attack isn’t traced back to the add-on, it starts its malicious activity an hour after being installed. When ...