Hackers took advantage of a security flaw to make it appear as if spam was being sent from users’ friends while other online malcontents fooled 90,000 users into installing a snooping third-party Chrome plug-in.