Stop browser attacks before anything runs.
Fake CAPTCHAs, phishing pages, Device Code scams and brand-new look-alike sites — stopped inside the browser, before anything runs. Core protection is free for everyone. At work, your team also gets the exact command and the full attack chain in one console.
ByteMantle is a browser detection and response platform: a free extension that stops attacks inside Chrome and Edge, and a console where your security team sees every incident with its whole chain, the exposure of the sites your people use, and sends it all to your SIEM, ServiceNow or your own tools.
Detection runs locally. No new browser, no proxy, no SASE project. Works in Chrome and Edge.
- CriticalDevice Code phishingMicrosoft sign-in · 2 devices
- CriticalClipboard command blockedfake verification page
- HighMalicious service worker removedWordPress site
- HighLook-alike domain, 4 days oldshop •••-paypa1.com
- ExposureSupplier portal: exploited flaw in its CMSCISA KEV
This page tried to steal your Microsoft sign-in.
In the user's browser — before anything ran.
Free protection for your own browser
Stops fake CAPTCHAs and copy-paste attacks, and warns you about brand-new and look-alike websites. No account needed; detection runs on your computer.
Protection for home →Protection your team can see and control
Every attack as one incident with the full chain, signed policies for your fleet, SIEM forwarding — and on Enterprise, the exposure of the supplier sites your people use.
For Business → · Enterprise →The browser is your blind spot. Here is how ByteMantle closes it.
2:28 · played from this site, nothing loads until you press play · also on YouTube
Not just a blocked page. The whole attack, on one map.
Most tools stop at the URL. ByteMantle follows the attack: where the user came from, every redirect, the scripts the page loaded, and every other device that reached it — joined into one incident with a verdict.
- See how the user got there, not only where they ended up
- The same kit on other sites, the same page on other devices
- 16 correlation rules, mapped to MITRE ATT&CK
Eight layers of protection, one console
Every layer starts in the browser, on the endpoint, where cloud proxies and email gateways can’t see.
Paste & Command Defense
See the exact command an attacker tried to make your user run — decoded, explained and mapped to MITRE. 92 rules across Windows, macOS and Linux, on every clipboard write path.
Identity Phishing
Device Code phishing (Microsoft, Google, GitHub, AWS, Okta), browser-in-the-browser and blob phishing.
Infrastructure Intelligence
Domain Age Guard, redirect cloakers and fleet-wide website risk scoring.
Web3 & RPC Shield
Detects EtherHiding, flags risky wallet approvals and profiles every contract your browsers call.
Service Workers
Finds and removes malicious workers that keep a lure alive after the tab is closed.
Attack-Chain Correlation
16 correlation rules turn scattered signals into one incident with a verdict.
Integrations
SIEM forwarding (Splunk, Elastic, Microsoft Sentinel, CEF), ServiceNow incidents and a Read API for your own tools.
Technology & Exposure
The software behind the sites your people use, matched with known and exploited vulnerabilities and end of support. Enterprise.
Your team sees what the browser saw.
The console turns browser events into investigations: the command, the infrastructure, the chain, and every other device that met the same payload.
- Correlated incidents with MITRE ATT&CK and a clear verdict
- Intelligence and payload prevalence across your fleet
- Deploy in minutes with Group Policy, Intune or Google Admin — no new browser
- One signed policy per organisation and your own warning page with “Report to IT”
- EU-hosted, or run the console on your own server
- Link opened from an emailOutlook on the web
- Redirected through 2 sitescloaked redirect
- Device sign-in code on a 4-day-old sitelooks like Microsoft
- Blocked in the browser, user warnednothing was entered
Know the weak spots of the sites you depend on.
Your own sites, your suppliers and your customers: the software behind each one, matched with known and exploited vulnerabilities and end of support — learned from the sites your people really use, with no scanning.
- An exposure score for your sites, your suppliers and your customers
- Critical suppliers ranked by how much your people use them
- An alert when a declared site changes, and a report to send to the supplier
- A register of ICT third parties for NIS2 and DORA
- CriticalPayroll supplier: plugin with an exploited flawCISA KEV
- HighCustomer portal: Drupal 7, end of supportsince Jan 2025
- HighYour web shop: WordPress, 3 known flawsupdate available
Your payroll supplier now runs a plugin with an exploited flaw.
38 of your people used it this month. The supplier report is ready to send.
More than a blocker: one place for every browser attack.
Incidents and the whole attack chain
Every attack becomes one incident: the site, the lure, the infrastructure, the command it tried to run, mapped to MITRE ATT&CK, with every other device that met it.
Technology & Exposure of the sites your people use
The software behind your suppliers' and SaaS sites, matched with known and exploited vulnerabilities and end of support; an exposure score, a register of ICT third parties for NIS2 and DORA. Enterprise.
SIEM, ServiceNow and the Read API
Threat events to Splunk, Elastic, Microsoft Sentinel or any webhook within a minute; an incident in ServiceNow for every attack; a Read API for reports, dashboards and AI assistants.
Policy, groups and fleet
One signed policy per organisation or group, deployment with Group Policy, Intune or Google Admin, browsers behind on updates, and your own warning page with "Report to IT".
Built for the companies the giants don’t build for.
Latest research
One smart contract, a new payload server every few days
A domain 13 hours old at its first use, then a new one: why block lists fall behind.
Read the research →The ClickFix beacon
The fake CAPTCHA command that reports you to Google Apps Script before the download.
Read the research →ClickFix report: 5–11 November 2026
32 hacked sites, 11 smart contracts, the commands and where they download from.
Read the report →Want to see it on your own browsers?
Free protection for everyone; trials, proofs of concept and pilots for teams.