Comment by KellyCriterion

I had a C-level guy who installed on his fresh notebook a FireFox extension from the wrong domain, it contained mailware - he missed the official link in Google and clicked on whatever scammer site to download the extension :-X