Phixo launches Gmail/Outlook phishing detector with 1.4M threat signals

Phixo is a Chrome extension for Gmail and Outlook that detects phishing emails before users click, now available in early access. The tool tracks 1.4M+ threat indicators and pulls from 5 intelligence sources per scan, returning a risk score and plain-English explanation in under 3 seconds. Installation requires one Chrome Web Store click, then sign-in via Google or Microsoft.

The body frames the phishing problem as a generational mismatch: "Modern phishing isn't a typo-ridden Nigerian prince email. It's a well-crafted message from a convincing lookalike domain — built to slip past every filter Gmail and Outlook ship with." It documents the attack chain—an email arrives from a spoofed sender (bank, Microsoft, CEO), the user clicks a link to a fake login page, enters credentials, and within eight seconds an attacker possesses the account. Recovery takes months. Against this backdrop, the body cites three data points: 3.4B phishing emails sent daily worldwide (APWG, 2025), 91% of cyberattacks beginning with phishing (Deloitte), and $4.9M average cost of a phishing breach (IBM, 2024).

Phixo's detection operates across four parallel layers: rules (instant), URL checking (fast), AI analysis (~1.5s), and domain reputation (fast), totaling under 3 seconds. The body lists the attack types it catches: CEO fraud, fake invoices, lookalike domains, typosquats, reply-to hijacking, brand spoofing, credential harvesting, wire fraud, and OAuth phishing. It shows example verdicts—a "CRITICAL" PayPal credential harvest, a "HIGH" Netflix billing scam, a "BLOCKED" malware dropper. The tool displays risk scores and explanations (e.g., the spoofed domain, the suspicious link, the manipulative phrase) so users can recognize similar tricks themselves.

Privacy is central to the pitch. Email bodies are "processed in memory and discarded the moment we return a score," never stored in the database—only a one-way cryptographic fingerprint and the verdict are kept. Links are hashed before reputation lookup. Nothing is used for training. Anonymous scan metadata (risk score, attack type, timing) is retained for scan history and model improvement.

Pricing offers a free tier (10 scans daily, all four detection layers, Gmail & Outlook, full explanations) and a Pro founder rate locked at $2.99/month for life, limited to the first 100 users; after that, Pro becomes $4.99/month or $39/year. Pro includes unlimited scans (capped at a fair-use limit of 300 per day to prevent abuse), full scan history, custom trust and block rules, priority AI lane, and all future Pro features included free.

The roadmap spans 2026. Inbox Sweep, currently in testing and Pro-only, will retroactively scan the last 30 days of mail in one click. A native Outlook desktop add-in, shipping later in 2026, targets users on Outlook desktop where browser extensions don't reach. Slack and Teams scanning launches Q2 2026 to cover inbound links in workspace channels. A SOC API, planned for late 2026, will allow POST requests from SIEMs and SOAR platforms for four-layer analysis. Currently a single-user product, a team plan will ship when the API does. Phixo is published on the Chrome Web Store by Phixo Labs, passed Google's extension review, and requests only minimum permissions needed to scan open emails. Its codebase ships inside the reviewed package with no remote code loaded; analysis is processed in real time on Phixo's servers and by its AI provider under a no-retention agreement, then discarded immediately.

Phixo enters a market where traditional spam filters have failed to keep pace with modern phishing tactics. The body documents the scale of the problem: 3.4B phishing emails are sent globally per day (APWG, 2025), and Deloitte reports 91% of cyberattacks begin with phishing. The financial stakes are concrete—IBM's 2024 data puts the average phishing breach cost at $4.9M per business. Traditional filters rely on known-bad sender lists and simple heuristics; Phixo's stated approach is to layer four independent checks (rules, URL scanning, AI, and domain reputation) in parallel and weight the combined signal, aiming to catch new attack types rather than only repeat patterns.

The product design emphasizes speed (under 3 seconds) and transparency. The body shows sample phishing emails (PayPal credential harvesting, Microsoft account spoofing) and highlights attack types it targets: CEO fraud, fake invoices, lookalike domains (typosquats), and reply-to hijacking. Crucially, the body states that email bodies are "processed in memory and discarded the moment we return a score" and "never written to our database," positioning privacy as a structural feature rather than a policy promise. The pricing model—$2.99/month locked-in for life for the first 100 founders—is a founder-acquisition tactic common in early-stage security tools, intended to build early adoption before raising prices.