PhishShield-AI
Catching the phishing emails that look legitimate, in real time.
The code is private, but I'm happy to walk you through it. Say hi.
At a glance
- Role
- Solo engineer: model, backend, extension
- Timeline
- Mar 2025 to now
- Status
- In active development
- Stack
- accuracy improvement over baseline
- 85%
- live threat feeds integrated
- 2
- real-time scoring in the inbox
- Inline
Overview
A Chrome extension pairing a trained classifier with live threat intelligence to score phishing attempts before the user clicks.
Generative models made convincing phishing cheap. Filters tuned on the old signals (bad grammar, obvious spoofs) do not catch a well-written, contextually plausible message, and that is now the common case.
The problem
Phishing drives the majority of breaches. Existing tools reliably catch obvious spam, but far fewer catch AI-generated, contextually convincing attacks in the seconds before someone clicks.
What I built
- Random Forest classifier trained for phishing email detection, delivering an 85% accuracy improvement over the baseline it replaced.
- Live threat intelligence from VirusTotal and URLHaus for proactive URL mitigation.
- Chrome extension surfacing inline threat scoring, backed by a Flask service.
- Hugging Face models for NLP-based content analysis of message intent.
Notes
Things that surprised me, or that I got wrong first.
Two signals, not one
The classifier reads language and intent; the threat feeds read reputation. Either alone produces false positives a user will learn to dismiss. Together they are worth interrupting someone for.
Scoring inline, not after the fact
A warning that arrives after the click is a post-mortem. The extension scores in the reading pane so the decision point and the warning are in the same place.
Say hi
If you want to talk about PhishShield-AI, or anything on this page, I'd love to hear from you. Email me or use the contact page.