AI

Bolster, creator of the CheckPhish phishing tracker, raises $14M led by Microsoft’s M12

Comment

Deepfake or Deep Fake Concept as a symbol for misrepresenting or identity theft or faking identification and misrepresentation in a 3D illustration style.
Image Credits: wildpixel (opens in a new window) / Getty Images

A dodgy email containing a link that looks “legit” but is actually malicious remains one of the most dangerous, yet successful, tricks in a cybercriminal’s handbook. Now, an AI startup called Bolster that has built a novel approach to tackle that trick has raised $14 million in funding to expand its work, both across a popular free phish-checking portal it operates called (appropriately) CheckPhish, as well as with its primary paying customers: brands and other businesses.

Microsoft’s venture fund M12 led the round as a new backer in the company, with participation also from Thomvest Ventures, Crosslink Capital, Liberty Global Ventures, Cheyenne Ventures, Cervin Ventures and Transform Capital. Bolster’s not disclosing its valuation but it has now raised around $40 million. 

Bolster’s business model is based around providing brand and URL checking services to businesses that spend a lot of time emailing their customers, and thus are prime candidates for malicious hackers to imitate in hopes of tricking people, or to simply copy with branding to sell products of their own. (Its client list includes big names like Dropbox, Uber, LinkedIn and Coinbase.) Phishing, according to the Cybersecurity Infrastructure Security Agency, is the start of more than 90% of all “cyberattacks,” which might include data breaches, network infiltrations or device viruses.

The ability to set up suspiciously similar-looking domain pages for these companies, and to start using them to run malicious phishing activities, has become very cheap and easy to do. 

“There are tools that you can purchase for $10 or $20 to launch phishing attacks,” said Bolster CTO Shashi Prakash (who co-founded the company with CEO Abhishek Dubey) in an interview. With malicious hackers now well versed in using AI, they create realistic login pages for banks, for example, and use phishing-as-a-service to launch these attacks “within minutes.” 

These have become more sophisticated, and more targeted, over time, he said. One recent example was the incident involving the CEO of WPP, Mark Read, who was at the center of a scam to try to solicit money. It sounds improbable when you read that out, and indeed it was unsuccessful, but it is just a sign of where these scams are going.

Bolster’s approach uses machine learning algorithms and AI techniques to track the wider internet — URLs, domain registration databases, conversations in open and closed forums and social media platforms, as well as emails (when it works with a client) and more — to detect scam operations, which it does on a continuous basis. When it identifies iffy links, it then shuts them down at their root by way of automated takedowns.

The approach is notable because it complements the myriad email security products that are on the market today that are adopted by organizations to help filter emails as they come into a person’s inbox: That’s still important as one mechanism to halt phishing activity. But in cases where those bad links pass through the gates unencumbered, the idea here is that, if a person does click on a link, now that person might not get anywhere. 

Considering that the wider funnel of email can be so complicated to contain, and hackers themselves makes themselves hard to find, identifying and shutting down the root of their operations becomes very valuable. 

“One of the advantages that Bolster has is its ability to automatically shut down where these attacks are originating from, they can shut down where those are hosted,” said Todd Graham, managing partner at M12, in an interview. “That is really, really important, given the scale at which these criminal enterprises operate.” Microsoft does not yet work directly with Bolster, Prakash said, but the idea is that this investment is a signal of how they will in the future.

Microsoft’s interest would be on a couple of levels: The company is a major international brand in itself, operating a number of services that would trigger emails to users (and I can personally attest to getting way, way too many “account login” emails from suspicious “Microsoft” links). On top of that, it’s a provider of cloud and managed and software services to numerous businesses, and thus an important link through to a large market of would-be customers. Lastly, it’s making a major move into putting more AI into all aspects of its business, and so threat protection inevitably has to be a part of that equation, too.

Graham added that while the company is effectively just a B2B business — with even the CheckPhish tool aimed at scanning websites rather than offering tools to individual users — the fact that it works with big brands by default gives it a consumer angle, in that it’s ultimately aiming at protecting the customers of the business in question. 

“If you are getting an impersonated email that claims to be from Microsoft, but it probably isn’t, it’s in the best interest of Microsoft or Wells Fargo or whoever, to ensure that that email, if it does go out, gets detected.”

More TechCrunch

Ola Electric, India’s largest electric two-wheeler maker, saw its shares rise as much as 20% on its public debut on Friday, making it the biggest listing among Indian firms in…

Ola Electric surges in India’s biggest listing in two years

Rocket Lab surpassed $100 million in quarterly revenue for the first time, a 71% increase from the same quarter of last year. This is just one of several shiny accomplishments…

Rocket Lab’s sunny outlook bodes well for future constellation plans 

In 1996, two companies, Patersons HR and Payroll Solutions, formed a venture called CloudPay to provide payroll and payments services to enterprise clients. CloudPay grew quietly over the next several…

CloudPay, a payroll services provider, lands $120M in new funding

The vulnerabilities allowed one security researcher to peek inside the leak sites without having to log in.

Security bugs in ransomware leak sites helped save six companies from paying hefty ransoms

Featured Article

A comprehensive list of 2024 tech layoffs

The tech layoff wave is still going strong in 2024. Following significant workforce reductions in 2022 and 2023, this year has already seen 60,000 job cuts across 254 companies, according to independent layoffs tracker Layoffs.fyi. Companies like Tesla, Amazon, Google, TikTok, Snap and Microsoft have conducted sizable layoffs in the…

A comprehensive list of 2024 tech layoffs

A new “beta rabbit” mode adds some conversational AI chops to the Rabbit r1, particularly in more complex or multi-step instructions.

Rabbit’s r1 refines chats and timers, but its app-using ‘action model’ is still MIA

Los Angeles is notorious for its back-to-back traffic. Three events that promise to bring in millions of spectators from around the world — the 2026 World Cup, the Super Bowl…

Archer to set up air taxi network in LA by 2026 ahead of World Cup

Featured Article

Amazon is fumbling in India

Amazon’s decision to overlook quick-commerce in India is now looking like a significant misstep.

Amazon is fumbling in India

OpenAI’s GPT-4o, the generative AI model that powers the recently launched alpha of Advanced Voice Mode in ChatGPT, is the company’s first trained on voice as well as text and…

OpenAI finds that GPT-4o does some truly bizarre stuff sometimes

On Thursday, Box filled in a missing piece on its AI platform when it bought automated metadata extracting startup, Alphamoon.

Box adds crucial piece to its AI platform with Alphamoon acquisition

OpenAI has announced a new appointment to its board of directors: Zico Kolter. Kolter, a professor and director of the machine learning department at Carnegie Mellon, predominantly focuses his research…

OpenAI adds a Carnegie Mellon professor to its board of directors

Count Spotify and Epic Games among the Apple critics who are not happy with the iPhone maker’s newly revised compliance plan for the European Union’s Digital Markets Act (DMA). Shortly…

Spotify and Epic Games call Apple’s revised DMA compliance plan ‘confusing,’ ‘illegal’ and ‘unacceptable’

Thursday seeks to shake up conventional online dating in a crowded market. The app, which recently expanded to San Francisco, fosters intentional dating by restricting user access to Thursdays. At…

Thursday, the dating app that you can use only on Thursdays, expands to San Francisco

AI companies are gobbling up investor money and securing sky-high valuations early in their life cycle. This dynamic has many calling the AI industry a bubble. Nick Frosst, a co-founder…

Cohere co-founder Nick Frosst thinks everyone needs to be more realistic about what AI can and cannot do

Instagram is rolling out the ability for users to add up to 20 photos or videos to their feed carousels, as the platform embraces the trend of “photo dumps.” Back…

Instagram is embracing the ‘photo dump’

Welcome back to TechCrunch Mobility — your central hub for news and insights on the future of transportation. Sign up here for free — just click TechCrunch Mobility! Anyone paying…

Lyft ‘opens a can of whoop ass’ on surge pricing, Tesla’s Dojo explained and Saudi Arabia pumps $1.5B into Lucid

Flint Capital just closed its third fund at $160 million. Its has a unique strategy for finding its limited partner investors. 

Flint Capital raises a $160M through an unusual fund-raising strategy

Earlier this week it emerged that the DPC had instigated court proceedings seeking an injunction against X over the data processing without consent.

Elon Musk’s X agrees to pause EU data processing for training Grok

During testing, Google DeepMind’s table tennis bot was able to beat all of the beginner-level players it faced.

Google DeepMind develops a ‘solidly amateur’ table tennis robot

The X account announced that its Premium+ subscription would now be “fully” ad-free, leading some to question how this change would affect creator earnings.

As X sues advertisers over boycott, the app ditches all ads from its top subscription tier

Apple has further revised its compliance plan for the European Union’s Digital Markets Act (DMA) rulebook, which, since March, has forced it to give iOS developers more freedom over how…

Apple revises DMA compliance for App Store link-outs, applying fewer restrictions and a new fee structure

The rise of neobanks has been fascinating to witness, as a number of companies in recent years have grown from merely challenging traditional banks to being massive players in and…

Chime and Dave execs are coming to TechCrunch Disrupt 2024

If you visited the Wikipedia website on mobile this week, you might have seen a pop-up indicating that dark mode is ready for prime time.

How to enable Wikipedia’s dark mode

The home security company says attackers accessed databases containing customer home addresses, email addresses, and phone numbers.

Home security giant ADT says it was hacked

The Looking Glass Pro has a 6-inch display and a foldable base. It shows spatial images like those created with the Apple Vision Pro and iPhone 15 Pro.

Looking Glass’ new lineup includes a $300 phone-sized holographic display

TikTok’s latest offering is capitalizing on the app’s ability to serve as a discovery engine for other media — something its users already take advantage of by sharing short clips…

TikTok partners with Warner Bros. to become a discovery engine for TV and movies

Cocoon is a new startup built on the belief that greener steel production and the creation of concrete slag doesn’t have to be an either/or proposition.

Cocoon is transforming steel production runoff into a greener cement alternative

SoundHound, an AI company that makes voice interface tech used by car companies, restaurants and tech firms, is doubling down on enterprise services by playing consolidator in a crowded market.…

SoundHound acquires Amelia AI for $80M after it raised $189M+

Seeking mental health support is a complex process, but some founders believe that using AI to formalize techniques like cognitive behavioral therapy (CBT) can help folks who might not have…

Feeling Great’s new therapy app translates its psychiatrist co-founder’s experience into AI

The U.K.’s antitrust regulator has confirmed that it’s carrying out a formal antitrust investigation into Amazon’s ties with Anthropic, after Amazon recently completed a $4 billion investment into the AI startup.…

UK launches formal probe into Amazon’s ties with AI startup Anthropic