Keeper Security Launches AI-Powered Phishing Protection To Warn Users Before Entering Credentials on Fake Sites

On-device AI detects look-alike domains, spoofed sites and credential harvesting before a password is entered

CHICAGO, Oct. 22, 2026 /PRNewswire/ -- Keeper Security, the leading zero-trust and zero-knowledge identity security platform, today announces Phishing Protection, a new feature in the Keeper Browser Extension that warns users before they enter credentials on fraudulent login pages. Built on a zero-knowledge local AI engine, the feature detects look-alike domains, spoofed websites and brand impersonation directly in the browser, helping users avoid handing over credentials to a cybercriminal.

Credential abuse was involved in nearly 40% of breaches, according to the 2026 Verizon Data Breach Investigations Report. Attackers now use generative AI to craft look-alike domains and deceptive login portals to harvest users' credentials. However, these malicious websites often bypass traditional security filters. Keeper's Phishing Protection addresses that gap. The feature runs on the user's device and uses local machine learning to examine websites. The local AI model uses a zero-knowledge security architecture, meaning the user's data is never shared.

"Phishing attacks are no longer simple email scams; they are highly automated, AI-driven operations designed to trick users into handing over sensitive credentials and information," said Darren Guccione, CEO and Co-founder of Keeper Security. "When an adversary sets up a look-alike domain, form field or unofficial login portal, traditional security controls often fail to identify the threat until the damage is done. By embedding zero-knowledge AI into our browser extension, Keeper stops credential harvesting at the point of entry, giving individuals and organizations greater security and control." 

How Phishing Protection Works

The local AI engine automatically evaluates web pages for structural indicators commonly associated with credential-harvesting sites, including:

• Domain Impersonation: Look-alike characters (typosquatting) and brand names hosted on unofficial domains.
• Obfuscated Infrastructure: Login details hidden within URLs, suspicious IP addresses and unusual link structures.
• Deceptive Requests: Unofficial or untrusted sites actively requesting password inputs.

When Keeper detects a suspicious site, it immediately notifies the user and details the specific threat pattern identified. Users can view the threat breakdown, disable Keeper on that site or dismiss the warning. Enterprise administrators and individual users can restore access or re-enable autofill at any time from their blocked-sites list.

User Authority and Administrative Control

Designed for privacy-first credential defense, the feature is entirely optional and disabled by default. IT administrators can enable and manage Phishing Protection centrally through the Keeper Admin Console, and end users can configure their own settings in the browser extension.

"Security controls have to work at machine speed, and they cannot come at the expense of the zero-knowledge guarantees our customers depend on," said Craig Lurey, CTO and Co-founder of Keeper Security. "We engineered this AI engine to execute entirely on the local device using the customer's private key. It delivers continuous, proactive verification of web assets, ensuring that autofill is protected against sophisticated domain spoofing without creating a privacy trade-off."

Phishing Protection is available now as an opt-in feature in the Keeper Browser Extension, version 18.2.0. To learn more about Keeper's zero-knowledge security architecture, visit keepersecurity.com.

About Keeper Security
Keeper Security is the leading zero-trust and zero-knowledge identity security solution, trusted by millions of people and thousands of organizations globally. KeeperPAM® is Keeper's privileged access management platform that unifies password and passkey management, secrets management, privileged session management and endpoint privilege management in a single cloud-native platform, protected with quantum-resistant encryption. KeeperAI delivers real-time, AI-native threat detection across every privileged session. As AI agents proliferate and identity becomes the defining attack surface, Keeper governs access for humans, machines, non-human identities and AI agents, serving as the unified control plane for access, compliance and visibility across the enterprise. For more information, visit KeeperSecurity.com.

Learn more: KeeperSecurity.com

Follow Keeper: Facebook Instagram LinkedIn X YouTube TikTok

Media Contact
Katherine Benfield
ICR for Keeper Security
[email protected]

SOURCE Keeper Security