Etsy sellers have a new scam to watch for. Scammers have been sending sellers files called “design extractor.exe,” and the trick has become common enough to threaten small shops that depend on their designs.
The design extractor.exe files are malware. Once opened, they can infect your computer and steal your design files, which can then be resold or used without your permission. Etsy sellers are an easy target because their unique designs are what set their shops apart.
Be suspicious of any unexpected message that asks you to download and install a file. The sender usually poses as a customer who wants a custom order. Check who you are dealing with before you share files or personal details, and never run a program a buyer sends you.
Know what matters before your first meeting.
Get the weekday cyber brief for phishing, BEC, and social-engineering shifts teams are seeing now.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Keep your computer protected too. Install anti-virus and anti-malware software, change your passwords regularly, and keep your operating system and software up to date with the latest patches.
If you do receive a message containing a design extractor.exe file or any other suspicious attachment, do not download or open it under any circumstances. Instead, report the message to Etsy’s support team and delete it immediately.
This scam can cost a seller their designs and their business. Watch for odd file requests, keep your security software current and report suspicious messages, and your shop and your designs will be much harder to steal.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Monday’s brief: ConnectWise Cloud Backup comes back, then Aruba Wi-Fi fixes, a Brotli update and Nextcloud’s KEV deadline
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.