AiTM Security
HijackShield provides a browser extension paired with a local on-device agent that detects and blocks phishing at the point of click, defeating evasion techniques that fool email gateways. When a page is blocked, zero-touch remediation automatically purges all copies of the phishing email tenant-wide via Microsoft Sentinel in approximately 8 minutes. The platform detects AiTM proxy attacks, Browser-in-the-Middle, Browser-in-Browser, device code phishing, and ClickFix attacks across Chrome, Edge, Brave, Opera, and Firefox on Windows.
- Cybersecurity
- Artificial Intelligence
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
Email security gateways routinely miss sophisticated phishing attacks, particularly Phishing-as-a-Service kits that use anti-analysis detection, CAPTCHA gates, and anti-debugger traps to evade sandbox-based scanning. Business email compromise (BEC) attacks from compromised trusted senders often bypass filters entirely, leaving users to click malicious links and SOC teams to spend hours manually finding and purging threats across mailboxes.
Solution
HijackShield is a browser extension paired with a local on-device agent that detects and blocks phishing at the point of click in the user's actual browser. By running on real user machines, the platform defeats the evasion techniques that fool email gateways — either the phishing page renders and is blocked instantly, or the kit exits early and the user never sees a threat. When a page is blocked, zero-touch remediation traces the click back to the source email, classifies it as external phish, BEC, or internal account takeover, and automatically purges every copy from all mailboxes via Microsoft Sentinel. Detection uses a hybrid of on-device ML and 100+ heuristic rules producing explainable decisions with reason tags, with no cloud dependency for the scoring decision.
Target Audience
Primary customers are enterprise security operations teams and IT administrators using Microsoft 365 (Business Basic and up) who need phishing defense beyond email gateways and automated remediation integrated with Microsoft Sentinel.
Features
- Detects AiTM proxy attacks (Sneaky 2FA, Tycoon 2FA, EvilProxy, Salty 2FA, Mamba 2FA), Browser-in-the-Middle, Browser-in-Browser, device code phishing, and ClickFix attacks
- On-device Go agent runs hybrid ML model plus 100+ heuristic rules with explainable BLOCK/WARN/ALLOW decisions in milliseconds
- Zero-touch remediation through Microsoft Sentinel: purges all copies of the phishing email tenant-wide in approximately 8 minutes (tested across 1,372 mailboxes)
- PhaaS kit fingerprinting provides SOC teams with immediate attribution on every blocked page
- Local detection with no data leaving the device for scoring; extension communicates with agent only over loopback interface
- Coverage includes brand impersonation (Microsoft, Google, Okta, Meta, LinkedIn, Amazon, Apple), government impersonation (36 US agencies), fraudulent e-commerce, and dangerous download protection with 82+ RAT patterns
- Malicious website protection against ClickFix scams, drive-by dangerous downloads, fraudulent stores, and browser push-notification abuse
- Weaponized document detection for accounts-payable invoice fraud and PDFs exploiting known CVEs
- Legitimacy evidence scoring reduces false positives via federated SSO, payment processors, and Schema.org signals
- Multi-browser support: Chrome, Edge, Brave, Opera, and Firefox on Windows, with macOS on the roadmap