I don’t have any insider knowledge or anything but only suspicions - I have friends who have developed relatively simple browser extensions like dark mode ones

I don’t have any insider knowledge or anything but only suspicions - I have friends who have developed relatively simple browser extensions like dark mode ones / filtering ones etc. Once they get to like 100k DAU popularity level you’ll start getting emails from people who claim to want to purchase the extension from you for a few thousand or “sponsor” the development by supporting you with ads. You either sell it, or include some JavaScript that later (few weeks) turns malicious and starts harvesting. That’s probably how. Like I say, I have no idea if that’s how these people work, but it seems a likely attack vector.