Keeper Security has introduced a new AI-powered phishing protection feature designed to prevent users from entering their credentials on fraudulent websites.
Available through the Keeper Browser Extension, the new Phishing Protection capability uses a local AI engine to detect look-alike domains, spoofed websites and brand impersonation attempts. By identifying suspicious login pages directly in the browser, the feature aims to prevent credential theft before sensitive information reaches cybercriminals.
The launch comes as credential-based attacks continue to pose a significant threat to organisations. According to the 2026 Verizon Data Breach Investigations Report, credential abuse was involved in nearly 40% of breaches.
Meanwhile, cybercriminals are increasingly using generative AI to create convincing fraudulent websites and login portals that imitate legitimate services, making phishing attempts more difficult for users and traditional security tools to identify.
Unlike conventional phishing detection tools that may rely on cloud-based analysis, Keeper’s new feature uses machine learning that operates entirely on the user’s device. Built on Keeper’s zero-knowledge security architecture, the technology analyses websites locally without sharing user data.
“Phishing attacks are no longer simple email scams; they are highly automated, AI-driven operations designed to trick users into handing over sensitive credentials and information,” said Darren Guccione, CEO and Co-founder of Keeper Security.
“When an adversary sets up a look-alike domain, form field or unofficial login portal, traditional security controls often fail to identify the threat until the damage is done. By embedding zero-knowledge AI into our browser extension, Keeper stops credential harvesting at the point of entry, giving individuals and organisations greater security and control.”
Detecting Phishing Attempts at the Point of Entry
Keeper’s Phishing Protection feature automatically examines web pages for characteristics commonly associated with credential-harvesting attacks.
These include typosquatting techniques, where attackers use domains that closely resemble legitimate websites, as well as suspicious IP addresses, unusual URL structures and unauthorised websites requesting password information.
When a potential threat is identified, the extension displays a warning explaining the suspicious activity and the specific indicators detected.
Users can review the warning, dismiss it or disable Keeper on the affected website. They can also manage previously blocked sites and restore autofill functionality where appropriate.
The feature is designed to provide an additional layer of protection against phishing attacks that evade existing email security gateways and web filtering technologies.
Privacy and Administrative Control
Keeper has also emphasised the privacy-focused design of the new capability, with its AI engine processing website information locally rather than transmitting sensitive data to external servers.
“Security controls have to work at machine speed, and they cannot come at the expense of the zero-knowledge guarantees our customers depend on,” said Craig Lurey, CTO and Co-founder of Keeper Security.
“We engineered this AI engine to execute entirely on the local device using the customer’s private key. It delivers continuous, proactive verification of web assets, ensuring that autofill is protected against sophisticated domain spoofing without creating a privacy trade-off.”
The feature is optional and disabled by default. Enterprise IT administrators can enable and manage it centrally through the Keeper Admin Console, while individual users can configure their preferences directly within the browser extension.
Keeper Phishing Protection is available now as an opt-in feature in version 18.2.0 of the Keeper Browser Extension.
