Disrupting ShieldGuard: a security extension primed to drain crypto wallets

Okta Threat Intelligence uncovered and helped dismantle "ShieldGuard", a fraudulent cryptocurrency project that distributed a malicious browser extension via a multi-level marketing airdrop campaign; the extension masqueraded as a wallet-protection tool but harvested wallet addresses and sensitive data from major crypto platforms (Binance, Coinbase, MetaMask, OpenSea, Phantom, Uniswap) and Google services, and captured full HTML content after user sign-ins.