PhishGuard AI: Browser-Based Phishing Detection Extension

202210874 Khaled Haddad

202120268 Mohamad Alhomsi

202211395 Mohamed Saad

202011630 Omair Masood

Email phishing remains one of the most dominant and financially damaging forms of cybercrime in the world today. The Anti-Phishing Working Group recorded over 3.8 million distinct phishing websites in 2025, with the FBI Internet Crime Complaint Center reporting losses of approximately 20.8 billion dollars from internet crime in the same year. Conventional detection tools, such as blocklist based filters, rule based spam engines, and even machine learning algorithms, work reactively. These tools must wait for a threat to be detected and fail against zero-day phishing campaigns that exploit a gap of knowledge in their datasets. This report presents PhishGuard AI, a Google Chrome extension that addresses this gap through a three-layer hybrid detection architecture. The first layer is a Random Forest classifier trained on 689,817 email samples drawn from five public datasets. The model was trained using 16 structural features extracted from email body text. The model achieves 94% weighted accuracy and an AUC-ROC of 0.9801 on a held-out test set that reflects real-world class distribution. The second layer is a locally hosted large language model running through Ollama, which performs semantic analysis to detect urgency tactics, sender impersonation, and social engineering patterns. The third layer queries the URL scanning APIs to check all extracted URLs against known threat databases. All three layers execute in parallel inside the browser, no email content is transmitted to any external server at any point.