About
What is Check?
Check is a browser extension that provides real-time protection against Microsoft 365 phishing attacks.
Specifically designed for enterprises and managed service providers, Check uses sophisticated detection algorithms to identify and block malicious login pages before credentials can be stolen by bad actors.
Check is available for Chrome, Microsoft Edge, and Firefox (109+ Coming Soon!).
The extension integrates seamlessly with existing security workflows, offering centralized management, comprehensive logging, and optional CIPP integration for MSPs managing multiple Microsoft 365 tenants.
Check is completely free and open source, can be delivered to users fully white-labeled, and is licensed under AGPL-3. You can contribute to Check at https://github.com/cyberdrain/Check.
Installing the extension immediately gives you protection against AITM attacks and takes seconds. Click the install button and you're good to go.
Why was Check created?
Check was created out of a need for better protection against AITM attacks. During a CyberDrain brainstorming session, CyberDrain's lead developer came up with the idea to create a Chrome extension to protect users:
This led to a hackathon in which the team crafted a proof of concept. This proof of concept led to the creation of Check by CyberDrain. CyberDrain decided to offer Check as a free-to-use community resource for everyone.
What information does Check collect?
Nothing. We're not even kidding: we don't collect any data at all. You can set up a CIPP reporting server if you'd like, but it reports directly to your own environment. CyberDrain doesn't believe in making its users a product. We don't sell or collect any information.
How does it look?
When the extension is added for a user, a new icon will appear. This icon is brandable, allowing you to customize it with your own logo and name.
When you visit a suspicious page but our certainty that it is phishing is too low, we'll show a banner to warn you. If we're sure that the page is an AITM or phishing attack, we'll block it entirely:
This too is completely brandable, and can be made to match company colours. The Contact Admin button is a mailto: link that contains the information about what page the user tried to visit, including a defanged URL.
Last updated