CyberLens: AI Scam Shield

Scan live calls, generate shareable warning links & hash files locally — 8-tool suite, 7+ APIs, offline fallback. Caught 19/20 phishing samples in testing.

Comment

💡 Inspiration

Cybersecurity today is built for corporations, not people. Scammers are no longer sending poorly worded emails asking for your bank details. They are cloning voices with AI, building phishing websites that look indistinguishable from the real thing, and setting up crypto traps that empty wallets in seconds.

  • Enterprise companies have entire teams of security analysts watching over them around the clock
  • Your grandparents have an antivirus program that has not been updated since 2010

👉 That gap is what CyberLens: AI Scam Shield was built to close, putting the power of Google Gemini AI and VirusTotal's 70+ scanning engines directly into the hands of everyday users, for free.

⚙️ What it does

CyberLens is a comprehensive, all-in-one cyber safety suite powered by 10 distinct tools and 7+ integrated security APIs. It caught 19 out of 20 known phishing samples in our internal test set.

  • Voice Call Analyzer is the only tool in this hackathon that fights vishing in real time. Hold your phone up to your computer during a suspicious call and our browser native SpeechRecognition API transcribes it live:

    • IRS scam detection as it happens
    • Grandparent scam pattern recognition
    • Tech support fraud script detection

  • Shareable Warning Links is a zero-database community defense tool. When you detect a phishing link, the full AI threat analysis gets cryptographically encoded into the URL itself using base64:

    • No server required
    • No account needed
    • No database involved, just math

  • Zero-Upload File Hashing uses the browser's crypto.subtle Web Crypto API to generate a SHA-256 hash entirely on your device:

    • Only the cryptographic fingerprint is sent to VirusTotal
    • Your file never leaves your machine

  • Password Lab offers strength and entropy analysis with breach checking via k-anonymity:

    • Your password is hashed locally with SHA-1
    • Only the first five characters of the hash are sent to HaveIBeenPwned
    • Your actual password is mathematically never transmitted

  • Privacy Checkup is a full digital footprint audit that reveals what any website can silently read about you:

    • IP address, ISP, and geolocation
    • Canvas fingerprint and hardware concurrency
    • Browser timezone and more

  • Website Inspector scans any domain's HTTP security headers and TLS configuration, grading it A through F:

    • Checks for missing Content-Security-Policy
    • Checks for missing X-Frame-Options and HSTS
    • Flags all critical misconfigurations

  • Phishing Dojo is a gamified training simulator that teaches users to spot phishing red flags before they ever need the analyzer:

    • Fake PayPal receipts
    • Compromised Netflix alerts
    • Spoofed bank transfers

  • Chrome Extension lets you scan any link without leaving your current tab:

    • Right-click any URL
    • Get an instant threat assessment in seconds

🛠️ How we built it

We architected CyberLens as a fully decoupled, privacy-first system where sensitive user data never touches our server.

  • The frontend is built on React and Vite with a custom glassmorphism CSS design system from scratch:

    • No UI libraries used
    • Every component hand-crafted for a cyberpunk command center aesthetic
    • Makes security feel accessible rather than intimidating

  • The backend is a Node.js and Express server acting as a secure API gateway:

    • Hardened with helmet for HTTP security headers
    • Protected with express-rate-limit to prevent DDoS and API quota exhaustion
    • All API keys isolated server-side, never exposed to the client

  • The AI and intelligence layer uses Google Gemini 2.5 Flash for deep contextual reasoning:

    • Does not just flag threats, explains in plain English why something is dangerous
    • Tells you exactly what to do about it
    • Fed structured data from VirusTotal, Google Safe Browsing, URLScan, and AbuseIPDB as grounding context

  • Privacy-first engineering relied on native browser web APIs:

    • crypto.subtle for client-side SHA-256 and SHA-1 hashing
    • SpeechRecognition for live voice analysis
    • Tesseract.js for on-device OCR

👉 APIs integrated: VirusTotal, Google Gemini 2.5 Flash, Google Safe Browsing, URLScan.io, AbuseIPDB, HaveIBeenPwned, and IPinfo.

⚠️ Challenges we ran into

Building CyberLens on free-tier APIs with enterprise-grade expectations pushed us to solve three real engineering problems.

  • Multi-API async orchestration was the core technical challenge, coordinating four parallel API calls into one coherent Gemini prompt:

    • Used Promise.allSettled() so no single slow API blocks the entire pipeline
    • Partial results still produce a valid, weighted threat report

  • The file privacy paradox required scanning files for malware without ever receiving them:

    • Solution was crypto.subtle.digest('SHA-256', fileBuffer)
    • Entire hash computation happens inside the browser's native cryptographic engine
    • Only the hex fingerprint travels over the network

  • Rate limit survival on free-tier APIs required careful queue design:

    • VirusTotal's free tier allows only four requests per minute
    • Built a client-side request queue with graceful degradation
    • If VirusTotal is throttled, the analyzer falls back to Gemini-only analysis with the offline heuristic engine

🏆 Accomplishments we are proud of

We set out to build something privacy-first and technically novel, and we delivered on both.

  • Built a zero-database Shareable Warning Link requiring no backend infrastructure whatsoever
  • Achieved zero-upload file scanning using browser-native crypto.subtle:
    • Sensitive files never leave the user's device, ever
  • Implemented k-anonymity for password breach checking:
    • A cryptographic technique used in production security tools at scale
  • Shipped a Chrome Extension alongside a full web application, two separate products in one hackathon
  • Delivered 10 distinct security tools covering five real-world attack vectors:
    • Phishing and vishing
    • Malware and data breaches
    • Browser fingerprinting

👉 Our multi-API and Gemini pipeline caught 19 out of 20 known phishing samples in our internal test set.

🧠 What we learned

We went into this hackathon knowing security. We came out knowing how to make AI think like a security analyst.

  • Learned to prompt-engineer Gemini as a strict cybersecurity analyst, not a general assistant:

    • Forced structured JSON threat reports instead of conversational answers
    • Required specific fields: risk score, threat type, scam DNA, and remediation steps

  • Deeply explored native browser web APIs and what can be pushed to the client edge:

    • The Web Crypto API is production grade
    • crypto.subtle is the same cryptographic primitive used in end-to-end encrypted messaging applications

👉 The biggest lesson was that privacy and performance are not opposites. With the right browser APIs, you can do more by sending less.

🚀 What's next for CyberLens

  • Twilio SMS Bot will bring threat analysis directly to any phone number:

    • Forward any suspicious text to our number
    • Receive an instant AI threat analysis back via SMS
    • No app required

  • Real-Time Live Radar will upgrade the dashboard with live global attack data:

    • Pulls anonymized data from threat intelligence feeds
    • Visualized on a real-time 3D globe

  • One-Click Takedowns will turn our users into active defenders:

    • Automatically generates DMCA and abuse reports
    • Sends them directly to the hosting providers of detected scam websites

Built With

Share this project:

Updates

Submission history