More than 4 million browsers have been infected by a China-based threat actor that published browser extension apps as a front to distribute malware.