Systems and methods for discovering and alerting users of potentially hazardous messages
This disclosure generally revolves around providing users with advance warning that a message that they have received may be suspicious. The user may not be aware of known threats, may not recognize threats in real time, or may not be aware of new threats, and therefore may unintentionally interact with a hazardous message. A security awareness system, on the other hand, is aware of known threats and may become aware of new threats more quickly than users can be trained to identify them. The system may notify the user when one of these threats are found in their messages. The disclosure further provides systems and methods for updating the security awareness training for users for new threats that appear.
1. A method for determining an email is a suspected phishing email prior to displaying the email, the method comprising:
(a) intercepting, by an agent executing on a client device, an email to be displayed on a display of the client device in response to detecting a process for the email instantiated by a messaging application responsive to an action of a user, the agent comprising a plug-in to the messaging application;
(b) pausing, by the plug-in of the agent, the process prior to displaying the intercepted email;
(c) identifying, by the plug-in of the agent prior to the intercepted email being displayed, content of the intercepted email;
(d) determining, by the plug-in responsive to one or more rules of the agent prior to the intercepted email being displayed, that the content of the intercepted email has one or more attributes associated with a phishing email; and
(e) modifying, by the plug-in of the agent prior to the intercepted email being displayed, the intercepted email to provide one or more notifications to be displayed with the intercepted email to identify that the intercepted email is a suspected phishing email.
2. The method of claim 1 , wherein the one or more notifications are displayed with the intercepted email responsive to a user one of previewing or opening the email.
3. The method of claim 1 , wherein (d) further comprises applying, by the agent, the one or more rules to the content of the intercepted email.
4. The method of claim 1 , wherein (d) further comprises transmitting, by the agent, portions of the content of the intercepted email to a server to determine by the server whether the intercepted email is a suspected phishing email.
5. The method of claim 4 , further comprising receiving, by the agent from the server, an indication that the content of the intercepted email is associated with the phishing email.
6. The method of claim 5 , further comprising receiving, by the agent from the server, one of identification of or information on the one or more attributes of the content of the intercepted email associated with the phishing email.
7. The method of claim 5 , further comprising receiving, from the server, an identification of whether the portion of the content has an attribute associated with one or more phishing emails, the indication received by the server from a second server.
8. The method of claim 5 , further comprising receiving, from the server, a determination from the portion of the content of the intercepted email that a reply-to-address of the intercepted email does not correspond to a sender of the intercepted email.
9. The method of claim 1 , wherein (d) further comprises determining, by the agent, that a link in the content of the intercepted email has a number of subdomains exceeding a predetermined threshold.
10. The method of claim 1 , wherein the one or more notifications comprises one of the following: a text box between a header of the intercepted email and a body of the intercepted email, a pop-up box displaying a warning to a user or modification of one of a format or the content of the intercepted email to provide the one or more notifications.
11. A system for determining an email is a suspected phishing email prior to displaying the email, the system comprising:
an agent executing on a processor, coupled to memory, of a client device, wherein the agent comprises a plug-in to a messaging application and the plug-in is configured to:
intercept an email to be displayed on a display of the client device in response to detecting a process for the email instantiated by the messaging application responsive to an action of a user;
pause the process prior to displaying the intercepted email;
identify, prior to the intercepted email being displayed, content of the intercepted email;
determine, responsive to one or more rules of the agent prior to the intercepted email being displayed, that the content of the intercepted email has one or more attributes associated with a phishing email; and
modify, prior to the intercepted email being displayed, the intercepted email to provide one or more notifications to be displayed with the intercepted email to identify that the intercepted email is a suspected phishing email.
12. The system of claim 11 , wherein the one or more notifications are displayed with the intercepted email responsive to a user one of previewing or opening the intercepted email.
13. The system of claim 11 , wherein the agent is further configured to transmit portions of the content of the intercepted email to a server to determine by the server whether the intercepted email is a suspected phishing email.
14. The system of claim 13 , wherein the agent is further configured to receive from the server an indication that the content of the intercepted email is associated with the phishing email.
15. The system of claim 13 , wherein the agent is further configured to receive from the server one of identification of or information on the one or more attributes of the content of the intercepted email associated with the phishing email.
16. The system of claim 13 , wherein the agent is further configured to receive, from the server, an identification of whether portion of the content of the intercepted email has an attribute associated with one or more phishing emails, the indication received by the server from a second server.
17. The system of claim 11 , wherein the agent is further configured to receive, from the server, a determination from the portion of the content of the intercepted email that a reply-to-address of the intercepted email does not correspond to a sender of the intercepted email.
18. The system of claim 11 , wherein the agent is further configured to determine that a link in the content of the intercepted email has a number of subdomains exceeding a predetermined threshold.