Is ScamsShield safe to use?

ScamsShield has a security risk score of 77.66/100 (HIGH risk). Our security analysis detected 1427310 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of ScamsShield?

Based on our automated security analysis, ScamsShield presents high risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Tracked campaign: trackingnumbers.org

Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →

Also reported by malext.io

Chrome Web Store

ScamsShield

by [email protected] · 4 users · 5.0 rating

bcdb535f-3e71-5382-9d91-d2a6e32c5179 | v1.49.8

HIGH risk

+14 since v1.46.0

Threat verdict

Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed: 2 days ago
Version: v1.49.8
Artifact: SHA256 D4B…D1C
Source: Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

95 detail rows

YARA Rule Matches

18 rules

Severity	Rule	Hits	Files	Metadata
HIGH	`memory shylock`	1	threats-bootstrap.json	https://github.com/jackcr/ FP 10%
LOW	`credential env files`	1	threats-bootstrap.json	-
LOW	`WarpStrings`	1	threats-bootstrap.json	-
LOW	`Cerberus`	1	threats-bootstrap.json	-
LOW	`credential skype data`	1	threats-bootstrap.json	-
LOW	`postinstall persistence mechanism`	5	scamdb.jsonpopup.jscontentScript.js +2 more	-
LOW	`postinstall crypto operations`	10	i18n.jscontentScript.jsbackground.js +7 more	-
LOW	`credential steam data`	1	threats-bootstrap.json	-
LOW	`postinstall file manipulation`	11	i18n.jspopup.htmlthreats-bootstrap.json +8 more	-
LOW	`PM Email Sent By PHP Script`	1	threats-bootstrap.json	-
LOW	`postinstall registry modification`	2	contentScript.jsthreats-bootstrap.json	-
LOW	`postinstall obfuscation`	3	contentScript.jsbackground.jsthreats-bootstrap.json	-
LOW	`postinstall network communication`	15	i18n.jsthreat-suffixes.jsonTHREAT_DATA_LICENSES.txt +12 more	-
LOW	`postinstall system command`	10	cosmetic.jsthreat-policy.jscheckoutGuard.js +7 more	-
LOW	`postinstall file download`	10	popup.jsbackground.jsthreat-suffixes.json +7 more	-
LOW	`NoUseWeakRandom`	1	contentScript.js	-
LOW	`LocalStorageShouldNotBeUsed`	2	guards.jscheckoutGuard.js	-
LOW	`DebuggerStatementsShouldNotBeUsed`	1	threats-bootstrap.json	-

Show network indicators (1,427,215)

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

Noisy-finding weight

x1.00

Publisher domain

No domain

Missing

Store verification signal

Limited signal

Limited

Extension portfolio

Portfolio

13 evidence rows available.

Finding Categories

Malware Signatures

Network

1,427,215

IoC Indicators

YARA Rules Matched

18 rules(77 hits)

memory shylock credential env files WarpStrings Cerberus credential skype data postinstall persistence mechanism postinstall crypto operations credential steam data postinstall file manipulation PM Email Sent By PHP Script postinstall registry modification postinstall obfuscation postinstall network communication postinstall system command postinstall file download NoUseWeakRandom +2 more

Requested Permissions

9 permissions

http://*/*

Dangerous

https://*/*

Dangerous

tabs

Medium

activeTab

Medium

storage

Low

alarms

Low

contextMenus

Low

declarativeNetRequest

Low

https://zdhuuprqhhvrzyvynixf.supabase.co/*

Low

Security Analysis Summary

Security Analysis Overview

ScamsShield is a Chrome Web Store extension published by [email protected]. Version 1.49.8 has been analyzed by the Risky Plugins security platform, receiving a risk score of 77.66/100 (HIGH risk) based on 1427310 security findings.

Risk Assessment

This extension presents high security risk. Significant concerns were identified during analysis. It is not recommended for use in sensitive or production environments without thorough review.

Findings Breakdown

High: 1 finding(s)
Medium: 1427233 finding(s)
Low: 76 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

ScamsShield is published by [email protected] on the Chrome Web Store marketplace. The extension has approximately 4 users.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Chrome version history

Risk trend by version

8 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected

Change since first

+15

Change from previous

+14

Versions:

First analyzed version

1.8.4

Aug 28, 2026

Risk range

62 to 78

Across analyzed versions

Latest analyzed version

1.49.8

Oct 25, 2026

Selected version

high

Version

v1.49.8

2 days ago

Risk score

Findings

1427310

Change vs previous

+14

Pick any point on the chart to explore that version's code below.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

About This Extension

ScamShield – Protect Yourself from Scams, Phishing, and Fake Websites Not sure if a link, message, or website can be trusted? ScamShield checks suspicious links, emails, messages, and QR codes in seconds for typical scam and phishing warning signs — and explains clearly what it found and what to do next. Features: 🛡️ Risk Scan – Check URLs, emails, invoices, and messages in real time for scam indicators 🔒 Password Check – Find out if your credentials have been compromised 🖼️ Image Scan – Upload a screenshot and have it analyzed for phishing signs 📱 QR Code Check – Detect malicious QR codes before you scan them 🌐 IP Lookup – Verify the trustworthiness of IP addresses ₿ Crypto Protection – Spot scam attempts in the crypto space Learn as You Go: 🎓 In our Phishing Training Academy, sharpen your skills with interactive quizzes — from beginner to advanced level — and learn to spot suspicious content on your own. Community & More: 👥 Connect with other users, read up-to-date warnings on our blog, and stay ahead of the latest scam tactics. Premium: 👑 ScamShield Premium unlocks higher scan limits, bulk scans, CSV export, and priority access to new features. ScamShield helps you stay safer online — fast, easy to understand, and with no technical knowledge required.

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

ScamsShield

Awaran

MEDIUM

Intelbras Cloud

[email protected]

CRITICAL 10K users

Edge Translate - Text Selection Translation

[email protected]

CRITICAL 1K users

Edge Translate - Browser Translator | PDF Translation | MV3 | Open Source

[email protected]

CRITICAL 312 users

SlingPlayer for DISH Anywhere

Unknown Developer

CRITICAL 10K users

MV3前端助手

[email protected]

CRITICAL 9 users

ScamsShield

Analysis record

Evidence ledger

NET-FETCH-popup.js-1341

NET-FETCH-contentScript.js-3261

NET-FETCH-background.js-56

NET-FETCH-popup.js-1453

NET-FETCH-contentScript.js-3617

NET-FETCH-background.js-1307

NET-FETCH-checkoutGuard.js-472

NET-FETCH-popup.js-433

NET-FETCH-contentScript.js-3348

NET-FETCH-popup.js-1457

NET-FETCH-background.js-1242

NET-FETCH-scamdb.js-28

NET-FETCH-popup.js-360

NET-FETCH-background.js-1322

NET-FETCH-contentScript.js-3430

NET-FETCH-popup.js-1377

NET-FETCH-background.js-983

MANIFEST-SENSITIVE-PERM-TABS

YARA Rule Matches

Publisher Evidence

Finding Categories

YARA Rules Matched

Requested Permissions

Security Analysis Summary

Security Analysis Overview

Risk Assessment

Findings Breakdown

What Was Analyzed

Developer Information

Recommendation

Risk trend by version

About This Extension

Frequently Asked Questions

Similar Extensions

ScamsShield

Intelbras Cloud

Edge Translate - Text Selection Translation

Edge Translate - Browser Translator | PDF Translation | MV3 | Open Source

SlingPlayer for DISH Anywhere

MV3前端助手