ShieldCrypt phishing kit

The form stays encrypted in the initial HTML

ShieldCrypt stores its form layout in a text/plain script element with the id elementor-value and data-enc="1". The page loads ./render/elementor.js and runtime scripts, then adds a full-page white spinner named __dc_shield_loader. A captured copy wraps this loader in a courier homepage with placeholders for the forms.

The runtime posts the visitor's session, page, domain, path and browser-automation checks to /api/user/initClient. The response supplies a clientToken and a contentKey. The script Base64-decodes the key and encrypted content, XORs the content with the repeating key and writes the decoded layout back into the element.

Interaction reveals the form

The runtime waits for a pointer, touch, click, key, scroll or mouse-movement event before it renders the decoded layout and removes the spinner. It saves that interaction state in session storage so a later page in the same session proceeds straight to rendering.

The renderer builds labelled inputs, submit buttons and payment-card sections inside the page's layout placeholders. When the layout's mixStyle setting is off, it uses Shadow DOM, a separate document tree that keeps the form's styles apart from the surrounding page.

A visitor session carries operator commands

The runtime opens a same-host WebSocket at /ws?kind=visitor with the session ID and client token. Its message handler accepts redirects, reloads, approval and error messages, and commands to fill a verification-code field. The page keeps form values across its navigation in browser storage.

What we see

Month	New sites
September	105
October so far	1

Checking a ShieldCrypt page

Keep the initial HTML, runtime scripts and session response. Look for:

• elementor-value with type="text/plain" and data-enc="1"
• ./render/elementor.js, /*shield*/ and data-shield markers
• the __dc_shield_loader spinner covering the page
• /api/user/initClient returning contentKey and clientToken
• a form appearing after browser interaction
• a visitor WebSocket carrying the session ID and client token

Remove the encrypted page, renderer, runtime and session handlers. Review hosting and deployment access and rotate the credentials that placed the files.