Disrupting ShieldGuard: a security extension primed to drain crypto wallets
ID: f89f5520-e038-5c38-ab44-caa5b345ab34
STIX ID: report--f89f5520-e038-5c38-ab44-caa5b345ab34
Feed Name: Threat Intelligence | Blog | Okta
Date Published: 2026-03-16
Date Updated: 2026-07-16
Author: Grayson Schermerhorn, Yang Wang, Simon Conant, Adam Smallhorn
Okta Threat Intelligence discovered and assisted in dismantling “ShieldGuard,” a fraudulent browser extension marketed as a cryptocurrency wallet protector and promoted via a multi-level marketing/airdrop campaign. Analysis shows the extension harvested wallet addresses and sensitive data (including full HTML after sign-in) from major crypto platforms and Google services, enabling potential theft and fraud.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.