PhishWatch

Detects browser-native phishing attacks like ConsentFix, ClickFix, and Browser-in-the-Browser that bypass traditional security.

PhishWatch PhishWatch helps detect browser-native phishing attacks that bypass email filters because these attacks do not activate until after delivery, inside your browser. Modern phishing no longer requires suspicious-looking domains. Attackers increasingly use legitimate cloud infrastructure, AI-generated content, and browser-native techniques to steal credentials, and ClickFix has been identified as a leading initial access technique (Microsoft 2025). PhishWatch operates in the browser, where these attacks must execute to succeed. WHAT PHISHWATCH DETECTS ClickFix (Windows, macOS, and FileFix) Helps detect social engineering attacks that trick users into copying and executing malicious commands disguised as verification steps, system fixes, or troubleshooting actions. Includes UNC path and File Explorer address-bar variants. Clipboard inspection occurs locally and is never transmitted. Adversary-in-the-Middle (AiTM) Helps identify credential-flow mismatches associated with reverse-proxy phishing attacks that relay credentials to legitimate services in real time, harvest session cookies, and bypass MFA protections. Includes WebSocket relay variants used by Tycoon 2FA. Identity Provider Clone Detection Helps detect login pages whose structure closely matches Microsoft or Google sign-in pages but are hosted on unverified domains, helping identify cloned authentication portals before credentials are entered. Device Code Phishing Helps detect abuse of OAuth device authentication flows (RFC 8628), where attackers socially engineer victims into authorizing attacker-controlled sessions using legitimate vendor authentication pages. ConsentFix (OAuth Token Hijacking) Helps detect attempts to paste OAuth authorization codes into fraudulent login pages and blocks the paste. Browser-in-the-Browser (BitB) Helps detect browser window spoofing techniques that simulate legitimate authentication pop-ups through deceptive page overlays. Passkey Downgrade Detection Helps detect attempts to redirect passkey-based authentication flows to password-based authentication on unverified hosts. Payment Data Harvesting Helps detect pages and fake browser windows that request bank account (IBAN) or card details on sites imitating a known brand or registered very recently. The entered numbers are checked locally and never transmitted. Typosquatting and Newly Registered Domains Performs real-time brand similarity analysis and domain age evaluation against over 130 frequently impersonated brands. Fake Update and AI Lure Detection Helps detect SocGholish-style fake browser update prompts and phishing pages impersonating AI services, particularly when combined with ClickFix social engineering techniques. HOW IT WORKS PhishWatch monitors navigation events and evaluates browser mechanics rather than relying on blocklists or visual page appearance. Detection is event-driven and activates only when meaningful risk indicators are present. Normal browsing continues without interruption. When a risk is detected, PhishWatch presents a clear, explainable warning describing the specific mechanical reason for the alert. Users always retain the option to proceed. PRIVACY BY DESIGN Most detection runs entirely on the user's device. Cloud-based risk scoring may be triggered when local signals indicate a potential threat. When a cloud check is performed, PhishWatch sends the address being checked and sanitized signal metadata. Parameter values are removed from page addresses, and only the domain is stored. PhishWatch never transmits: • Clipboard contents • Page content or DOM data • Form field contents, including bank or card numbers • Passwords • Cookies • Session tokens • Your browsing history (only the address of a link flagged by local checks is sent, and only its domain is stored) • Personal identifiers FOR MANAGED SERVICE PROVIDERS PhishWatch can be deployed through Chrome managed policies using Google Admin Console, Microsoft Intune, Group Policy, or RMM tools that push Chrome policies. Alerts can be sent to NinjaOne, Datto, ConnectWise, and other tools via webhooks. Features include: • GDPR Article 28 documentation • NIS2 Article 21 mapping support • Frankfurt-hosted infrastructure • 30-day pilot programs for DACH-based MSPs DESIGNED FOR TRANSPARENCY • Built on Chrome Manifest V3 • No eval() and no remotely hosted code • Deterministic and explainable detections • Fail-open design: uncertainty never blocks navigation • All warnings can be overridden by the user Privacy Policy: https://phishwatch.io/privacy MSP Pilot Program: https://phishwatch.io/pilot Website: https://phishwatch.io