Basically they first need to get a remote shell and are then able to replace the extension source with the modified one.

This article does a good job explaining it more in depth.[0]

0: https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is...