akuma0x1.world (home)

AI-powered email threat detection extension

A browser extension for Gmail and Outlook, co-developed at AMAN Security, that analyzes incoming email in real time with an AI classification model. When a message is flagged, the extension blocks interaction with it until the user acknowledges the warning, and it processes email content without storing or retaining user data.

  • Documented
  • Updated
Type
Product (AMAN Security startup), co-developed
Platforms
Gmail, Outlook
Status
On hold (maintained in production from 2025)
Key result
98% detection accuracy (internal testing)
Focus
Phishing links, Spoofed senders, Attachments, BEC / look-alike domains

Problem

Email is still where many attacks start. Phishing links, spoofed senders, malicious attachments and business-email-compromise messages all arrive in the same inbox as legitimate mail, and the final decision to click usually rests with the user, often under time pressure created by the message itself.

The goal was to put a check at the point where that decision is made: inside the mailbox, in real time, as the email is read. That check had to do two things: catch the threat, and stop the user from acting on it by reflex. It also had to do this without keeping a copy of anyone's email.

Architecture & approach

Email threat detection flow An email opened in Gmail or Outlook is passed to the extension, which analyzes it with detection logic covering links, sender domains, attachments and language, and an AI classification model that returns a real-time verdict. Both process content without storing or retaining it. If a threat is detected, the extension blocks interaction with the email and shows a warning until the user acknowledges it. If no threat is detected, the email opens normally. Email opened Gmail · Outlook no storage · no retention Detection logic links · sender domains attachments · language AI classification model real-time verdict no threat threat No threat detected email opens normally Threat detected block interaction with the email warning shown until acknowledged
simplified detection flow. Logical view only; where the model is hosted is not shown.

The design follows the moment a user reads an email:

  1. Analyze in place. The extension runs inside Gmail and Outlook and analyzes incoming email in real time, so the check happens before the user acts.
  2. Look at several signals, not one. Detection logic covers links, sender domains, attachments and the language of the message itself (see the table below).
  3. Classify with a model. An AI classification model produces the verdict for each email.
  4. Interrupt, don't just label. When a threat is detected, interaction with the email is blocked until the warning is acknowledged.
  5. Keep nothing. Email content is processed without being stored or retained, following privacy-by-design principles.

Detection signals

Threat categories covered by the detection logic
SignalThreat it targets
Phishing linksLinks that lead to credential-harvesting or malicious pages
Spoofed sender domainsMail claiming to come from a domain it was not sent from
Malicious attachmentsFiles delivered as the payload of the attack
Social-engineering languageWording designed to manipulate the reader into acting
Urgency-based languageArtificial time pressure that discourages checking
Look-alike / BEC-style domainsDomains imitating a trusted organization or contact (business email compromise)

What I did

  • Co-developed and maintained a browser extension for Gmail and Outlook that analyzes incoming emails in real time using an AI classification model.
  • Built detection logic for phishing links, spoofed sender domains, malicious attachments, social-engineering and urgency-based language, and look-alike or BEC-style domains.
  • Implemented protective controls that block user interaction with detected threats until the warning is acknowledged.
  • Applied privacy-by-design principles: email content is processed without storing or retaining user data.
  • Maintained the system in production from 2025 to protect users against email-based threats.

Tools

Components of the extension and their role
ComponentRole in the product
Browser extensionRuns in Gmail and Outlook; analyzes incoming email in real time
AI classification modelClassifies each email and produces the threat verdict
Detection logicCovers links, sender and look-alike domains, attachments, social-engineering and urgency language
Protective controlsBlock interaction with a flagged email until the warning is acknowledged

Result

98% detection accuracy in internal testing of the classification model, with the extension maintained in production from 2025 to protect users against email-based threats. The AMAN Security project is currently on hold.

Lessons learned

  • A warning has to interrupt to work. Blocking interaction until the warning is acknowledged puts a deliberate pause between the user and the risky action.
  • Phishing is more than a bad link. Spoofed senders, look-alike domains and urgent, manipulative wording each need their own detection, and they often appear together.
  • Privacy is a design constraint, not a feature. Deciding up front not to store or retain email content shaped how the system could be built and maintained.
  • A test score is a starting point. 98% in internal testing is a measurement on a specific test set; running the system in production is what shows how it holds up.