Chrome extension developers are facing a highly convincing phishing campaign that abuses trust, urgency, and publicly available extension information to steal Google account credentials. The attack masquerades as an official copyright infringement notice and falsely claims that a developer’s extension is scheduled for removal from the Chrome Web Store unless immediate action is taken. The scam is specifically designed to target extension publishers and gain access to their developer accounts.
How the Scam Operates
The attack begins with what appears to be an official copyright removal request. Victims are informed that their Chrome extension has allegedly violated copyright policies and will be removed from the Chrome Web Store within 48 hours. The notification creates a sense of urgency and directs developers to a website that presents itself as a legitimate Chrome Web Store policy portal.
Once on the fraudulent website, developers are asked to provide their extension ID or extension URL. At first glance, this request appears harmless because extension IDs are publicly accessible. However, the website uses this information to retrieve legitimate data associated with the extension, including its name, icon, and listing information. By displaying authentic extension details, the attackers create a convincing illusion that the complaint is genuine. The complaint number, takedown notice, timeline, deadline, and other legal-looking information displayed on the page are entirely fabricated and generated by the phishing platform.
Why Chrome Extension Developer Accounts Are Valuable Targets
Developer accounts represent a significant security target because Chrome extensions have extensive interaction with users’ browsers and can receive automatic updates. If attackers successfully compromise a developer account, they may gain the ability to modify extension code, access associated developer resources, alter configurations, or potentially distribute malicious updates to an existing user base.
This creates a powerful attack vector. Instead of targeting thousands of individual users, cybercriminals can compromise a single trusted developer account and leverage that trust relationship to affect a large number of extension users. This potential for supply-chain compromise makes extension publishers particularly attractive targets for phishing operations.
The Social Engineering Techniques Behind the Attack
One of the most effective aspects of this scam is its use of psychological manipulation. The phishing page prominently displays a countdown timer, warning banners, and a strict 48-hour deadline. These elements are designed to trigger emotional responses and reduce the likelihood that victims will carefully verify the legitimacy of the request.
The website also impersonates Google’s branding and presents itself as a “Chrome Web Store Developer Policy Center.” Although the domain used in the analyzed campaign was unrelated to Google, the visual design closely mimics official Google interfaces. By combining authentic extension information with fabricated legal notices, the attackers create a highly believable scenario that pressures developers into taking immediate action.
The Fake Google Sign-In Window
Perhaps the most technically deceptive element of the scam is the counterfeit Google authentication window. After developers attempt to appeal the alleged copyright complaint, the site displays what appears to be a Google login screen, complete with a padlock icon and an address that resembles accounts.google.com.
However, the login prompt is not a real browser authentication window. It is merely a graphical component embedded within the phishing page. The attackers even customize the appearance to match the victim’s operating system, displaying Mac-style or Windows-style interfaces as appropriate. Any credentials entered into this form are transmitted directly to the attackers. A key indicator of fraud is that the fake window cannot be dragged outside the browser page. Additionally, the browser’s actual address bar continues to display the phishing domain rather than a legitimate Google authentication URL.
Security Best Practices for Extension Developers
Developers can significantly reduce their risk by following several fundamental security practices:
- Verify all policy notifications directly through the Chrome Web Store Developer Dashboard.
- Never trust links received through unsolicited notices.
- Be skeptical of countdown timers and urgent deadlines.
- Confirm that authentication pages are displayed through legitimate browser windows.
- Enable passkeys or hardware security keys whenever possible.
- Use strong multi-factor authentication methods.
- Deploy anti-phishing and web protection tools.
- Regularly monitor extension listings for unauthorized changes or uploads.
If credentials have already been submitted, immediate action should include changing the Google account password, reviewing active sessions, inspecting connected applications, enabling stronger authentication mechanisms, and checking extension listings for suspicious activity.
Indicators of Compromise (IOC)
dmca-chrome-extensions[.]click
Our Opinion: Why This Scam Is Particularly Dangerous
This phishing campaign demonstrates how modern cybercriminals have evolved beyond traditional email scams. Rather than relying solely on poorly written messages or obvious fake websites, attackers are now incorporating real-time data collection, personalization, and advanced social engineering techniques to increase credibility. What makes this campaign especially concerning is its focus on software developers. Developers are often viewed as technically skilled individuals who are less likely to fall victim to phishing attacks. However, this scam succeeds by exploiting workflow familiarity rather than technical ignorance. Copyright complaints, policy reviews, and compliance notifications are common events for extension publishers, making the fraudulent notice appear plausible.
Another alarming aspect is the potential downstream impact. A compromised developer account can affect not only the account owner but also thousands of extension users. This transforms a simple credential theft attempt into a potential software supply-chain attack. Such attacks can undermine user trust, damage brand reputation, and introduce malware into trusted ecosystems. We believe the strongest defense against these threats is a combination of security awareness and strong authentication practices. Developers should treat all unsolicited policy notifications with skepticism and verify claims directly through official dashboards. Organizations and individual developers should also adopt passkeys or hardware security keys wherever possible, as these technologies significantly reduce the effectiveness of credential phishing campaigns. Ultimately, the success of this scam highlights a simple reality: attackers increasingly rely on psychological manipulation rather than technical exploitation. Recognizing urgency-based tactics and independently verifying claims remains one of the most effective defenses available today.
