China-linked spies backdoored authentication stack to stay hidden for years