Crypto Scam ShieldGuard - Dismantled After Malware Discovery

What Happened

A recent cryptocurrency scam, known as ShieldGuard, has been dismantled following the discovery of its malicious intent. Initially marketed as a security tool to protect crypto wallets, this Chrome extension was actually designed to harvest sensitive user data. Researchers from Okta Threat Intelligence uncovered the operation, revealing that it utilized social media promotions and a token airdrop incentive to lure users into downloading the extension.

Users were promised rewards for promoting the extension, which falsely claimed to detect suspicious transactions. However, the reality was far more sinister. Instead of providing security, ShieldGuard was built to extract valuable information from users interacting with major crypto platforms like Binance, Coinbase, and MetaMask.

Malware Capabilities Revealed

The malware embedded within ShieldGuard had several alarming capabilities. It was able to:

• Harvest wallet addresses across all visited websites.
• Capture full HTML content from crypto platforms after users logged in.
• Track users persistently across sessions.
• Execute remote code via a command-and-control (C2) server.

Moreover, the malware employed advanced techniques such as obfuscation and a custom JavaScript interpreter to bypass Chrome's security measures. This allowed attackers to deliver and execute code dynamically without triggering standard protections, making it particularly dangerous for unsuspecting users.

Links to Wider Campaign and Takedown

Evidence from the investigation suggested that the operators of ShieldGuard may be Russian-speaking, based on language indicators found in the code. Additionally, researchers identified connections to another campaign known as Radex, indicating a broader threat network. In response to this discovery, Okta collaborated with industry partners to take decisive action against the operation.

The takedown involved removing the extension from the Chrome Web Store, disabling associated domains, and blocking user sign-in functionality. These measures effectively severed the communication between infected browsers and the attackers' servers, significantly reducing the threat posed by ShieldGuard.

What You Should Do