PhishGlass Alternatives: Tested Scam Detectors Compared

Date: 2026-10-20

5 representative sample messages were tested against each tool's free, no-cost interface. Only public features were used — no paid accounts or paywall bypasses.

• S1: ClickFix lure — Fake CAPTCHA page instructing user to press Win+R and paste a PowerShell command
• S2: QR code phishing — QR code embedded in a fake delivery notification email encoding a credential-harvesting URL
• S3: BEC invoice fraud — Email impersonating a vendor requesting urgent bank detail change for an outstanding invoice
• S4: MFA fatigue — Text message impersonating IT asking user to approve a pending MFA prompt
• S5: ConsentFix OAuth — Fake verification page instructing user to copy-paste a localhost OAuth URL
• S6: OAuth PhaaS (Kali365) — Microsoft 365 OAuth token theft via Kali365 phishing-as-a-service platform (IC3 PSA 260521)
• S7: Tax season phishing — Tax-themed phishing lure targeting 29,000+ users across 10,000+ orgs (Microsoft Threat Intelligence, Feb 2026)
• S8: AiTM "Code of Conduct" — Multi-stage credential theft with subject "Internal case log issued under conduct policy" leading to AiTM token compromise (Microsoft Defender Research, May 2026)
• S9: Microsoft image-based quishing — Image-embedded QR code impersonating Microsoft 365 login, bypassing email security (Sublime Security)
• S10: PayPal Cyrillic homograph — pаypal.com domain using Cyrillic "а" (U+0430) instead of Latin "a" for credential harvesting (Palo Alto Unit 42)
• S11: Amazon Greek homograph — amazοn.com domain using Greek omicron "ο" (U+03BF) with valid HTTPS certificate (Soluble/Matt Hamilton research)
• S12: Quanta supplier BEC — BEC attack impersonating Taiwanese supplier Quanta, sending fake invoices to Google and Facebook ($100M loss, BlueVoyant)
• S13: USPS smishing — SMS impersonating USPS with delivery notification link redirecting to Google credential harvesting page (BlueVoyant)
• S14: Fake Zoom link malware — Email containing fake Zoom meeting link deploying malware on hedge fund network ($800K loss, Levitas Capital, BlueVoyant)
• S15: Microsoft 365 password expiry — Fake email warning Microsoft 365 password expires in 24 hours with credential harvesting link (BrainstormInc 2026)
• S16: Outlook URL preview homograph — Homograph URL spoofing in Outlook preview pane impersonating Apple, exploiting hover-link display behavior (Bitdefender)
• S17: Spotify payment homograph — Homograph domain impersonating Spotify prompting users to resolve pending payment for card detail theft (ManageEngine)
• S18: Browser-in-the-Browser recruitment — Fake recruitment email with BitB attack displaying fraudulent Facebook login window for credential theft (HoxHunt 2026)
• S19: Crelan Bank executive BEC — BEC via compromised executive accounts instructing employees to transfer funds ($75M loss, Crelan Bank Belgium, BlueVoyant)
• S20: IRS / government impersonation — Email impersonating IRS claiming overdue taxes with credential harvesting link (35% increase in 2026, HoxHunt)

Limitations:

• Only free, no-cost features were tested. Paid tiers may behave differently.
• Norton Genie free was tested via the standalone web/app interface, not the Norton 360 bundled version.
• Bitdefender Scamio free was tested via the web app (scamio.bitdefender.com).
• Results reflect tool behavior on the test date and may change as products are updated.
• PhishGlass results were recorded from the live production scanner at phishglass.reverseai.org.
• Samples S6-S20 are based on documented real-world threats from public threat intelligence sources. Test messages were reconstructed from published IOCs and descriptions, not the original malicious payloads.
• Homograph samples (S10, S11, S16, S17) were tested as text descriptions of the domain plus the Punycode form, as the live domains are no longer active.