Keeper Security has added Phishing Protection to the Keeper Browser Extension, a feature that warns users before they type credentials into a fraudulent login page, using an AI model that runs on the user’s own device.
According to the company’s Oct. 22 announcement, the feature checks pages for look-alike characters in domains, brand names hosted on unofficial domains, login details hidden inside URLs, suspicious IP addresses, unusual link structures, and unofficial sites that request a password. When it flags a page, it notifies the user and names the threat pattern it found. The user can read the breakdown, turn Keeper off for that site or dismiss the warning, and users and administrators can restore access or re-enable autofill from the blocked-sites list.
Keeper says the model uses a zero-knowledge design, so user data is never shared. The feature ships in version 18.2.0 of the extension. It is optional and disabled by default. IT administrators can switch it on centrally through the Keeper Admin Console, and individual users can configure their own settings in the extension.
The company cites the 2026 Verizon Data Breach Investigations Report for its claim that credential abuse was involved in nearly 40% of breaches, and says attackers now use generative AI to produce convincing look-alike domains and login portals.
The default setting is the detail security teams will act on first. A control that is off until someone enables it protects only the accounts where an administrator turned it on, so the rollout plan matters as much as the model. Teams that run Keeper can enable it for one group and compare its warnings with the phishing reports users file today. Phishing that arrives by mail has been a recurring entry point on this site, including the active exploitation of a Cisco Secure Email Gateway flaw and the probing of mail servers between a Zimbra fix and its disclosure.
