Crypto Scam "ShieldGuard" Dismantled After Malware Discovery

Okta Threat Intelligence uncovered and helped dismantle 'ShieldGuard', a malicious browser extension marketed as a crypto wallet protector that instead harvested wallet addresses and session HTML from Binance, Coinbase, MetaMask and Google services, tracked users, and executed remote code via a command-and-control server; operators showed links to a broader 'Radex' campaign and industry partners removed the extension and disabled its infrastructure.