On-device AI detects look-alike domains, spoofed sites and credential harvesting before a password is entered
Keeper Security, the leading zero-trust and zero-knowledge identity security platform, announces Phishing Protection, a new feature in the Keeper Browser Extension that warns users before they enter credentials on fraudulent login pages. Built on a zero-knowledge local AI engine, the feature detects look-alike domains, spoofed websites and brand impersonation directly in the browser, helping users avoid handing over credentials to a cybercriminal.
Credential abuse was involved in nearly 40% of breaches, according to the 2026 Verizon Data Breach Investigations Report. Attackers now use generative AI to craft look-alike domains and deceptive login portals to harvest users’ credentials. However, these malicious websites often bypass traditional security filters. Keeper’s Phishing Protection addresses that gap. The feature runs on the user’s device and uses local machine learning to examine websites. The local AI model uses a zero-knowledge security architecture, meaning the user’s data is never shared.
“Phishing attacks are no longer simple email scams; they are highly automated, AI-driven operations designed to trick users into handing over sensitive credentials and information,” said Darren Guccione, CEO and Co-founder of Keeper Security. “When an adversary sets up a look-alike domain, form field or unofficial login portal, traditional security controls often fail to identify the threat until the damage is done. By embedding zero-knowledge AI into our browser extension, Keeper stops credential harvesting at the point of entry, giving individuals and organizations greater security and control.”
Also Read:ย CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
How Phishing Protection Works
The local AI engine automatically evaluates web pages for structural indicators commonly associated with credential-harvesting sites, including:
- Domain Impersonation:ย Look-alike characters (typosquatting) and brand names hosted on unofficial domains.
- Obfuscated Infrastructure:ย Login details hidden within URLs, suspicious IP addresses and unusual link structures.
- Deceptive Requests:ย Unofficial or untrusted sites actively requesting password inputs.
When Keeper detects a suspicious site, it immediately notifies the user and details the specific threat pattern identified. Users can view the threat breakdown, disable Keeper on that site or dismiss the warning. Enterprise administrators and individual users can restore access or re-enable autofill at any time from their blocked-sites list.
User Authority and Administrative Control
Designed for privacy-first credential defense, the feature is entirely optional and disabled by default. IT administrators can enable and manage Phishing Protection centrally through the Keeper Admin Console, and end users can configure their own settings in the browser extension.
“Security controls have to work at machine speed, and they cannot come at the expense of the zero-knowledge guarantees our customers depend on,” said Craig Lurey, CTO and Co-founder of Keeper Security. “We engineered this AI engine to execute entirely on the local device using the customer’s private key. It delivers continuous, proactive verification of web assets, ensuring that autofill is protected against sophisticated domain spoofing without creating a privacy trade-off.”
Catch more CIO Insights:ย How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write toย psen@itechseries.com ]
