Phishing Protector (Thunderbird)

The Thunderbird version of Phishing Protector is a Thunderbird add-on that automatically scans every email you open in the background and warns you when it finds signs of phishing. It performs the same checks as the Outlook add-in and uses the same backend for network-based scans. I wrote it in the Manifest V3 format for Thunderbird 128 and later.

Purpose

After writing the Outlook add-in, I saw that people around me who read their mail in Thunderbird needed the same protection. Instead of maintaining two separate scanning engines, I moved the checks into Thunderbird's add-on structure and kept the backend shared. That way you get results judged by the same criteria whichever email client you use.

How it works

The moment an email is displayed in Thunderbird, the add-on's background script is triggered. It fetches the full message as Thunderbird's MIME tree. MIME is the format that carries the parts of an email, such as plain text, HTML and attachments, nested inside each other. Real emails can have deeply layered structures, so I wrote a recursive function that finds the HTML body. The sender and reply-to address are parsed from the headers, and attachments are listed through Thunderbird's own API.

Then the email checks and link checks run. Clean links that pass them are sent to the shared backend, which looks at the DNS record, reachability and the VirusTotal result for each link in that order. Results are cached per message, a badge with the number of threats is added to the toolbar icon, and an operating system notification appears when a threat is found.

Clicking the shield icon in the message toolbar opens a popup that shows the cached result. If the scan is still running, it waits for it to finish. The popup also has a button to scan again.

Key features

• It flags sender spoofing when the display name mentions a well-known brand or bank but the email comes from another domain.
• It catches cases where the reply-to address points to a different domain.
• It searches the subject and body for Turkish and English pressure phrases.
• It checks more than 40 dangerous attachment extensions and forms or input fields embedded in the email.
• It detects fake domains written with Cyrillic, Greek or fullwidth characters, known as homograph attacks.
• It separately shows links whose visible text differs from their real target and addresses from 19 shortening services.
• It checks unregistered domains through DNS and harmful addresses through VirusTotal.
• Every email is scanned automatically, whether or not the popup is open.

Technical stack

The add-on is built on Thunderbird's WebExtension platform with plain HTML, CSS and JavaScript, without npm or a bundler. It uses Thunderbird-specific messenger.* APIs and only asks for permissions to read messages and show notifications.

The main difference from the Outlook version is where the scan happens. In Outlook the checks run in a task pane that stays visible, and nothing is scanned when the pane is closed. In Thunderbird the result popup only opens when you click it and closes as soon as you click elsewhere. So I moved all checks into the background script and kept the results cached by message ID. Since there is no page document in the background, links are parsed with the browser's URL object.

The backend is the FastAPI service shared with the Outlook add-in, so I did not need to write a new server.

Installation

During development the add-on can be loaded temporarily from Thunderbird's add-on debugging screen. For a permanent install, the project folder is compressed into a zip file, the extension is renamed to .xpi, and the file is installed from Thunderbird's add-ons screen.

Use cases

• It adds an extra warning layer against phishing for individual users and small offices that read mail in Thunderbird.
• It lets teams that use both Outlook and Thunderbird apply the same checks everywhere.
• Because it scans every email on its own and shows the result on the icon, it is practical even for users who forget to open a panel.
• It is a concrete example for developers who want to build Thunderbird add-ons and work with MIME structures.