How do you deal with fake product downloads from bots (Chrome Web Store, Play Store, AppStore)?
Over the past week, several Chrome extension owners (myself included) have experienced a rather unusual situation.
Bots apparently operating from Romanian IP addresses are mass-installing extensions, but the number of active users remains completely unchanged.
There is a suspicion that this is part of a coordinated wave of malicious activity where bots:
Mass-install extensions and then uninstall them shortly afterwards, potentially hurting their relevance and ranking in the Chrome Web Store.
Some creators have already excluded Romania from their list of available countries.
Have you ever experienced anything like this?
I'd love to hear from anyone who knows how this works, what the potential consequences are, and how to protect their products from this kind of activity.
Replies
AI Context Flow at the moment. What the fuck is happening here.
@hira_siddiqui1 I found more discussions on Reddit and still monitoring the situation:
1. https://www.reddit.com/r/chrome_extensions/s/mwV7n7wpT9
https://www.reddit.com/r/chrome_extensions/s/PjgtAvQQfJ
https://www.reddit.com/r/chrome_extensions/s/aqeDVz4ENY
Hello Nika,
Thanks for bringing attention to this issue. I just realized the same problem unusually excessive install from Romania. I think it's best to investigate it and if necessary report this issue to Google support. Something is definitely amiss here. The investigation from my extension shows that it's likely a bot and not an attack per-say. I think it's a sandbox test from a security vendor or threat crawler. My suspicion is Bitdefender which is headquartered in Romania. Other possible source could be someone studying your extension in order to clone or impersonate it.
Do you also see a lot of install by OS as Other rather than ChromeOS or Windows?