Five extensions were doing all sorts of malicious acts, including stealing payment data.