The attack, which began on Christmas Eve, exploited a vulnerability in the Chrome Web Store's developer authentication system ...