Keeper launches Verify Mode to block phishing logins

Keeper Security has launched Verify Mode in version 17.8 of its browser extension for enterprise users.

The feature checks where a user enters credentials and warns them if the website does not match the corresponding record stored in their Keeper vault. It is intended to stop users from submitting passwords to malicious or unrecognised sites at the point of entry.

Phishing remains a common route into corporate systems because it exploits employee behaviour as well as software flaws. Keeper cited Verizon research showing that 60% of breaches involved a human element, such as credential abuse or phishing scams.

Verify Mode monitors password paste activity in the browser. If it detects a mismatch between the destination site and the saved record, it displays an immediate warning before the credential is submitted, giving the user the option to proceed or cancel.

The release includes three protection settings that administrators can apply based on their organisation's risk tolerance. A medium setting alerts users when credentials copied from the vault are pasted into a different site from the one saved. A high setting warns users when a password is pasted into any site not stored in the vault.

At the strictest level, the browser extension requires confirmation before a password is pasted on any site, including one already recognised as trusted. This shifts control from background storage and autofill to an active checkpoint each time credentials are used.

Darren Guccione, Chief Executive Officer and Co-founder of Keeper Security, described the feature as a response to the moment when phishing attacks often succeed.

"Phishing attacks succeed by targeting the moment that users enter their credentials," said Guccione. "Even well-trained employees can be deceived by convincing, malicious websites. Verify Mode changes that by validating credential use in real time, ensuring passwords are only entered on trusted domains. It shifts credential security from passive storage to active protection," added Guccione.

Browser changes

The update also adds a prompt asking users to disable the built-in password manager in their browser and set Keeper as the default. This is intended to reduce conflicts between the extension and native browser password tools.

Another addition lets users create and edit custom fields directly in the browser extension instead of moving to the web vault. Those fields can be reordered by drag and drop and used to store items such as security questions, PINs or private notes linked to login records.

These fields are masked by default for privacy. Administrators can also enable Verify Mode and choose the level of protection through the Keeper Admin Console.

Identity focus

The update reflects a wider shift in cyber security products towards stronger controls on identity and credential use. As companies spread systems across cloud services, remote working environments and hybrid infrastructure, password theft remains one of the simplest ways for attackers to gain initial access.

Tools that monitor where credentials are entered have become more relevant as phishing pages increasingly mimic trusted brands, internal company services and software sign-in screens. In those cases, users may copy credentials from a password manager into a fraudulent page even if they have received awareness training.

Keeper positions Verify Mode as an extension of its broader zero-trust approach, applying checks not only to stored credentials but also to how they are used. By validating each interaction, organisations can apply tighter controls over where passwords are entered and reduce the role of human error in security incidents.

Keeper sells identity security and privileged access products to organisations in more than 150 countries. Its platform includes password management, secrets management, endpoint privilege management, threat detection and access controls for enterprise users.

Verify Mode is available through the Keeper browser extension for enterprise customers, with policy settings managed centrally by administrators through the Keeper Admin Console.