Article mentions infostealers. My guess would be a rogue browser extension but it could have just as easily been malware.