Keeper Security Adds On-Device AI Phishing Warnings to Its Browser Extension

Keeper Security has launched Phishing Protection, an optional feature in its browser extension designed to warn users about suspicious login pages before they enter their credentials.

Announced on October 22, the feature uses on-device machine learning to identify potential signs of credential harvesting, including look-alike domains, brand impersonation, and deceptive password requests.

Phishing Protection is available in Keeper Browser Extension version 18.2.0. It is disabled by default, so users or administrators must enable it.

Checking suspicious login pages locally

According to Keeper, the feature analyzes websites directly on the user’s device through a local AI engine built around its zero-knowledge security architecture.

The company says information processed by this local analysis is not shared externally.

The engine looks for structural indicators commonly associated with fraudulent login pages. These include domains that imitate familiar brands, suspicious URL structures, and unofficial sites requesting passwords.

Keeper positions the feature as an additional safeguard against deceptive pages that may escape other security filters.

Darren Guccione, Keeper Security’s CEO and co-founder, said increasingly automated phishing operations require protection closer to the moment a user enters sensitive information.

What the feature looks for

Keeper identifies three main categories of warning signs:

• Domain impersonation: Look-alike characters, misleading domain spellings, and brand names appearing on unofficial domains.
• Obfuscated infrastructure: Suspicious IP addresses, login information embedded in URLs, and unusual link structures.
• Deceptive requests: Password fields appearing on sites the engine considers unofficial or untrusted.

When the feature flags a site, Keeper displays a notification explaining the threat pattern it identified.

Users can inspect the warning, disable Keeper on the site, or dismiss the alert. Keeper says users and enterprise administrators can also restore access or re-enable autofill through the blocked-sites list.

These controls allow users to review a detection rather than treating every warning as a final determination that a website is fraudulent.

Optional settings for individuals and businesses

Individual users can configure Phishing Protection through the browser extension’s settings.

For organizations, IT administrators can enable and manage the feature centrally through the Keeper Admin Console.

Craig Lurey, Keeper Security’s CTO and co-founder, said the AI engine was designed to execute entirely on the local device while maintaining the company’s zero-knowledge approach.

The feature’s effectiveness will depend on its detection capabilities and whether it has been enabled. A warning system should be understood as an additional layer of protection, rather than a guarantee that every fraudulent page will be identified.

Availability

Phishing Protection is available now as an opt-in feature in Keeper Browser Extension 18.2.0.

Users and organizations can visit Keeper Security’s website for further information about the extension and its security architecture.

Find this story on GoogleKeeper Security Adds On-Device AI Phishing Warnings to Its Browser Extensiongoogle.com · Opens in a new tab↗