The fake extensions impersonated legitimate tools from major crypto services such as Coinbase and MetaMask, according to Koi Security.