Our Copyfish extension was stolen and adware-infested
> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen.<p>First, it is excellent that you disclosed the issue.<p>Second, based upon the quoted text you really aren't accepting responsibility for having been phished.  The team member wasn't "unlucky."  Your "radar" shouldn't trick you into thinking you won't be attacked.