PhishLens

Inspiration

Several members of our team are cybersecurity engineering students, so we wanted to build something connected to the problems we study. Phishing affects both everyday users and developers, yet many security tools provide warnings without explaining the evidence behind them. We created PhishLens to make phishing protection understandable, transparent, and actionable.

What it does

PhishLens is a browser extension that analyzes webpages in real time for signs of phishing and malware. It evaluates suspicious URLs, brand-domain mismatches, sensitive forms, cross-domain submissions, social-engineering language, and known-threat intelligence.

The extension produces a transparent risk score, identifies the evidence behind it, and recommends a safe action. It can also mark suspicious links and interrupt risky form submissions before credentials are sent. Its explanation layer translates technical findings into clear language without changing the underlying score or inventing evidence.

How we built it

We built PhishLens as a Manifest V3 browser extension using TypeScript. A content script extracts privacy-conscious page and form evidence, independent detectors convert that evidence into structured security signals, and a deterministic scoring engine produces a risk level from 0 to 100.

PhishLens combines local threat data with optional server-side threat-intelligence indexes. Its backend runs on AWS and provides evidence-based explanations with a deterministic fallback when the AI service is unavailable.

We used Codex powered by GPT‑5.6 throughout development to help design the architecture, implement and debug features, create safe phishing simulations, review privacy boundaries, and develop unit, integration, and adversarial tests. Our team reviewed and verified the resulting code and security behavior.

Challenges we ran into

One major challenge was keeping the extension dynamic as webpages changed, especially when forms or links were inserted after the initial page load. We also had to normalize URLs and synchronize multiple threat-intelligence datasets while preventing duplicate matches from unfairly increasing the score.

Another challenge was making AI-generated explanations detailed enough for technical users while remaining understandable to beginners. We addressed this by separating deterministic detection from explanation generation: the AI can clarify validated findings, but it cannot alter the score or introduce unsupported claims.

Accomplishments that we're proud of

We are proud that PhishLens goes beyond simply labeling a page as dangerous. It connects every warning to concrete, reviewable evidence and can intervene before sensitive information is submitted.

We also successfully connected the extension to an AWS-hosted backend, integrated multiple threat-intelligence sources, added proactive link protection, and designed graceful fallbacks so core detection continues working when external services are unavailable.

What we learned

We learned how phishing attack surfaces appear to everyday users and how attackers combine urgency, impersonation, misleading URLs, credential forms, and other social-engineering techniques.

We also learned that effective security tools must balance accuracy, privacy, usability, and explainability. A warning is significantly more useful when users understand what triggered it and what they should do next.

What's next for PhishLens

Our next goal is to prepare PhishLens for public release as a free browser extension. Before publishing it, we plan to strengthen transport security, expand testing against more real-world patterns, improve accessibility, and establish a reliable process for updating threat-intelligence datasets.

Longer-term possibilities include additional browser support, more advanced detection techniques, and optional tools for security teams—while preserving the privacy-conscious and evidence-based design at the core of PhishLens.

Built With

• amazon-web-services
• chatgpt
• codex
• css
• html
• javascript
• ollama
• openphish
• phishtank
• urlhaus