Hackers compromise a Cyberhaven developer account to push a malicious Chrome extension update that steals session tokens and passwords. The company quickly removes the compromised version and urges all affected users to rotate their credentials immediately.