Nothing new, a worm similar to this called LilyJade got a few million installs (using crossrider - a cross-browser extension thing) by spamming users facebook effectively bypassing csrf because they can read the webpage and spreading itself and banking the spammers a few hundread thousand dollars with CPA (survey scams - "please do this survey to unlock the content")