Disrupting ShieldGuard: a security extension primed to drain crypto wallets
ID: d158fcd0-2529-54a1-8f40-1d69a4105477
STIX ID: report--d158fcd0-2529-54a1-8f40-1d69a4105477
Feed Name: Okta Threat Intelligence
Threat Score
Date Published: 2026-03-16
Date Updated: 2026-08-05
Author: , Yang Wang, Simon Conant, Adam Smallhorn
...
...
Okta Threat Intelligence uncovered and assisted in taking down 'ShieldGuard', a fraudulent browser extension promoted via a multi-level marketing airdrop scheme that posed as a wallet-protection tool but harvested wallet addresses and sensitive page HTML from major cryptocurrency platforms (Binance, Coinbase, MetaMask, OpenSea, Phantom, Uniswap) and Google services.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.