Systems and methods to perform phishing detection and device attestation via browser extension

A system, comprising:

• one or more processors coupled to non-transitory memory, the one or more processors configured to:
• obtain, from a client device, a first activity log indicating one or more first activities purportedly performed via one or more software-as-a-service (SaaS) applications using a browser extension of the client device, the first activity log generated via a browser extension executing on the client device;
• receive, from a computing system providing the one or more SaaS applications, a second activity log indicating one or more second activities performed via the one or more SaaS applications using the client device;
• determine, using the first activity log and the second activity log, that the one or more first activities indicated in the first activity log fail to match the one or more second activities indicated in the second activity log;
• and
• initiate at least one remedial action in response to determining that the one or more first activities fail to match the one or more second activities.

A method, comprising:

• obtaining, by one or more processors coupled to non-transitory memory, from a client device, a first activity log indicating one or more first activities purportedly performed via one or more software-as-a-service (SaaS) applications using a browser extension of the client device;
• receiving, by the one or more processors, from a computing system providing the one or more SaaS applications, a second activity log indicating one or more second activities performed via the one or more SaaS applications using the client device;
• determining, by the one or more processors, using the first activity log and the second activity log, that the one or more first activities indicated in the first activity log fail to match the one or more second activities indicated in the second activity log;
• and
• initiating, by the one or more processors, at least one remedial action in response to determining that the one or more first activities fail to sufficiently match the one or more second activities.