Once thought to be a reliable indicator of trust, the blue ‘check’ icon next to an extension’s name can now be spoofed.