Multi-factor anti-phishing systems and methods

A method, comprising:

• receiving, at a user device, a webpage;
• extracting, by a feature extraction system at the user device, a set of features from the webpage;
• generating a feature vector based on the set of features;
• providing the feature vector to a machine-learning (ML) model;
• outputting, by the ML model, a prediction of whether the webpage represents a phishing attempt;
• receiving, via a user interface, user feedback indicating whether the prediction is accurate;
• providing the user feedback and the feature vector to a cloud secure enclave;
• and
• receiving, from the cloud secure enclave, an update to the feature extraction system at the user device.

A user device, comprising:

• at least one processor;
• and
• memory, operatively connected to the at least one processor and storing executable instructions that, when executed, cause the at least one processor to perform operations, the operations comprising:
• receiving a webpage;
• extracting, by a feature extraction system at the user device, a set of features from the webpage and generating a feature vector based on the set of features;
• providing the feature vector to a machine-learning (ML) model;
• outputting, by the ML model, a prediction whether the webpage represents a phishing attempt;
• receiving, through a user interface, user feedback indicating whether the prediction is correct;
• and
• providing at least the user feedback and the feature vector to a cloud secure enclave.