A new version of the infamous browser extension is spreading through files on websites offering pirated wares, and leverages unique persistence mechanisms.