Abstract: The technology described herein identifies and mitigates phishing attempts by analyzing user input received at the operating system level. Initially, a credential, such as a username or password, is registered with the threat detection system. The technology described herein intercepts user input at the operating system level, generates a hash of the input, and compares it with a hash of a credential being monitored. A credential entry is detected when a hash for the character string entered matches a hash for a credential being monitored. The technology described herein will perform a threat assessment when a secret entry is detected. The threat assessment may use the application context and the network context as inputs to the assessment. Various mitigation actions may be taken when a threat is detected.

Abstract: Non-limiting examples of the present disclosure enable creation and management of representations of content through the execution of copy actions, paste actions or a combination thereof. An indication of a copy action is received that copies a content portion. The copy action is analyzed to generate a (live) representation of the content portion. Other examples of representations are also generatable including a static representation and/or a live non-editable representation. As an example, a live representation is an editable and synchronized representation of the content portion that is synchronized with original source content. The live representation comprises a selectable data link that links back to the original source content and an editable representation of the content portion. In response to receiving an indication of a paste action, the live representation of the content portion is automatically rendered inline within a graphical user interface of a host application/service endpoint.