ScamsShield

AI Security Review

Evidence context: threat category none; evidence quality moderate.

ScamsShield describes itself as a phishing and safety checker: "Website safety indicators and phishing warnings while you browse. Local checks plus optional Premium AI analysis." The scanned files are JavaScript and JSON only, and nearly everything alarming in this scan traces back to one of them.

The indicator count is a blocklist. Roughly 1.4 million indicators land in the ioc bucket. The endpoint list shows why: entries such as 0-amazon.weebly.com, 00-974a.duckdns.org, 0-autht-lo-xfin-ity-w0965.vercel.app and 000-00-000-000000.pages.dev are throwaway phishing hosts parked on Weebly, DuckDNS, Vercel and Cloudflare Pages. A phishing warning extension does not contact those hosts. It ships them so it can compare the page you visit against them. A blocklist of N domains produces roughly N indicators, which is exactly what happened here.

The malware signature sits on the blocklist, not on code. YARA--memory_shylock fires at threats-bootstrap.json:1. Shylock names a Windows banking trojan family, and this build contains no native components or executables, only JavaScript and JSON. The rule matched hostnames inside a JSON array of known-bad domains. A signature that fires on a data file of scam hosts tells you the hosts are bad, which is the file's whole purpose.

The network findings fit the stated feature. NET-FETCH-background.js-56, NET-FETCH-popup.js-360 and NET-FETCH-contentScript.js-3261 are fetch calls in a product whose job is to ask a service about a URL before showing a warning. The checkoutGuard.js:472 fetch sits in a script named for the checkout flow, which is where a scam-warning tool would look for fake payment pages.

Permissions are narrow. Both permissions and host_permissions come back empty for this build, so the extension asks for no broad host access and no privileged APIs. A hijacker or session stealer needs cookies, tabs or webRequest access to do its damage. None of that is requested.

The 76 code-smell entries carry no weight. They are the standard YARA smell set that fires on any bundled JavaScript. None of them describes an action taken against a user.

A skeptical reviewer would say a four-user extension published under a gmail.com address, with a file called checkoutGuard.js and an AI-analysis upsell, has the shape of a data-harvesting PUP. The specific evidence does not support that. A harvester needs to read pages or cookies, and this manifest grants neither. It also needs a collector endpoint, and the only named hosts in the scan are blocklist entries rather than a first-party service. What would change this verdict: a manifest declaring <all_urls> or cookies, or a build where the fetch calls in checkoutGuard.js:472 point at a domain that is not a known vendor API. Neither shows up here.

The correct read is a low-install phishing checker whose blocklist inflated the indicator count and tripped a banking-trojan rule written for Windows binaries.

Key Reasons

• YARA--memory_shylock matches threats-bootstrap.json, a bundled scam-domain blocklist, not executable code
• The enormous IoC volume is explained by that blocklist: phishing hosts on weebly.com, duckdns.org, vercel.app and pages.dev are lookup data, not contact endpoints
• Fetch calls at background.js:56, popup.js:360 and contentScript.js:3261 match the extension's stated domain-lookup feature
• permissions and host_permissions are both empty, so no cookie, tabs or blanket host access is requested
• The 76 low-severity entries are generic YARA code-smell matches with no user-facing action described

False Positive Considerations

• Blocklist file expanded into one IoC per listed domain
• Banking-trojan YARA rule firing on a JSON data file rather than a binary
• Generic JavaScript code-smell rules on bundled source
• Phishing domains in the endpoint list misread as extension contact points

Reviewed 2026-10-28; recommended action: suppress false positive; model confidence 78%.