Doppelgängerby Iden

Stop phishing before anyone types a password.

A free Chrome extension that catches the phishing your employees can’t tell from the real thing: relayed Microsoft sign-ins, lookalike addresses, streamed browsers and senders posing as your CEO. It stops them on each machine, before a password goes in, and every check runs on the device.

Deploy to your teamAdd to Chrome
Every page and link your team opens passes through Doppelgänger as it loads, on their own machine.
See the seven attacks it stops

Seven ways phishing takes a password, each stopped before it’s typed.

Relayed sign-in
Microsoft’s real sign-in page, relayed through someone else’s server, takes the password and the session MFA creates. Doppelgänger blocks it on any address, before anything is typed.
Streamed browser
The sign-in is real, running in a browser on the attacker’s machine and streamed into the tab. Doppelgänger sees the keys going to a picture of a screen, and asks first.
Lookalike address
аpple.com with a Cyrillic а reads as apple.com and gets its own padlock. Doppelgänger reads the letters, not their shapes, and blocks the page as it loads.
Fake link
The link says Apple and goes somewhere else. It’s marked before the click, in any webmail and through Outlook Safe Links, Proofpoint and Mimecast.
Impersonated sender
The CEO’s name, on someone else’s address, asks Finance for a wire before 3pm. In Gmail, senders that pass for your company or one you know are marked where you read them.
Brand-new domain
A vendor’s billing portal, registered four days ago, asks for a password. Before the first password on any site you’ve never signed in to, Doppelgänger asks once, and says how new it is.
Typo domain
amazom.com asks you to update a payment method. A site one letter off a popular one, or off one you sign in to, gets a “Did you mean” note and a question before a password.

One policy installs it on every machine.

Force-install it with the MDM you already run: Jamf, Kandji, Mosyle or Intune on macOS, Group Policy on Windows, or the Google Admin console. People can’t turn it off, and the same profile turns on Chrome’s own password-reuse warning.

com.google.Chrome.mobileconfig
<key>ExtensionInstallForcelist</key>
<array>
  <string>ocnmklcdlgoancopbnnkehndjaiomhke;https://clients2.google.com/service/update2/crx</string>
</array>
<key>PasswordProtectionWarningTrigger</key>
<integer>1</integer>
Read the deployment guide

Everything stays on the device.

No account, no server. What it reads and keeps never leaves the browser. One lookup does: a domain’s registry is asked when the domain was registered, because a phishing site is usually days old. It goes straight to the registry, never to Iden.

Your employee’s browser
Read, checked and kept here
  • page addresses
  • where links go
  • Gmail senders
  • sign-in elements
  • that a password was typed
  • sites you sign in to
  • sites you said yes to
  • names in Gmail
Leaves the device
One lookup→the domain’s registry:when was northwind-billing.com registered?4 days ago
Read the privacy policy

Questions

Yes. No account, no trial, no paid tier. It’s made by Iden, which builds identity governance for IT teams.

No. Its one network request asks a domain’s registry when the domain was registered, only for a site asking for your password or an email sender it doesn’t know. It goes straight to the registry, never to Iden.

Click Continue anyway and the site is allowed for the rest of the session. If it collides with a site you sign in to, you’re asked which one is yours, and the answer sticks.

Tell us at support@idenhq.com, with the page or the steps that got through. We’ll fix it and credit you.

Chrome. Edge, Brave and Arc install extensions from the Chrome Web Store too; we test on Chrome.

No. It works where email security can’t reach: in the browser, after a link has passed every filter, on the page that asks for the password.

A stolen sign-in is an identity problem, and identity is what Iden governs. Doppelgänger is the part that works before anything is stolen.

Install it before the email arrives.

Free and with no account, from the Chrome Web Store. Or put it on every machine with one policy.

Add to ChromeDeployment guide