A seven-year malware campaign, orchestrated through seemingly trusted browser extensions, exposed millions of users to DNS abuse. ShadyPanda’s infrastructure reveals how trust, subtlety and DNS manipulation sustained an enduring threat.