So, as a web programmer, I'd like to infer how this data got into the marketplace in the first place. The offerings are all powered by browser data exfiltration! Which means their vector is another process on the host, or it could be a malicious browser extension, or a resource 0-day. Or the tokens could be exfiltrated from from the server-side, too.)
Does anyone know how they get this data?