AI-Powered Email Phishing Scanner

📌 Overview

This workflow automatically scans unread emails in Gmail, extracts any embedded URLs, checks them with VirusTotal, and analyzes the email content using AI for signs of phishing or scams. If an email is flagged as suspicious, it applies a warning label in Gmail for security tracking.

Category: IT & SecurityTrigger: New unread email in Gmail

⚙️ Workflow Steps

1. Gmail Trigger

• • Starts the workflow when a new unread email arrives.
  • Captures sender, subject, and email body.

2. Extract URLs (Code)

• • Uses regex to detect all links in the email body.
  • Removes duplicates and counts total URLs.

3. If There is URL (Filter)

• • Checks whether the email contains one or more links.
  • If no URL → routes to AI content analysis only.
  • If URL exists → continues to URL scanning.

4. VirusTotal URL Scan

• • Submits extracted URL(s) to VirusTotal API.
  • Retrieves analysis results for phishing, malware, or domain reputation.

5. Format URL Scan Results (Code)

• • Cleans and formats VirusTotal results into structured JSON.

6. AI Cybersecurity Assistant (OpenAI)

• • Analyzes both email content and VirusTotal results.
  • Decides if the email and its links are SAFE or SUSPICIOUS.
  • Provides reasoning and final judgement.

7. If Suspicious Email (Filter)

• • Checks AI’s verdict field.
  • If suspicious → routes to labeling.

8. Apply Gmail Label (Suspicious)

• • Adds a Suspicious Email label to the flagged message.
  • Helps security teams monitor potential phishing attempts.

✅ Key Benefits

• Automates phishing email detection in real time.
• Cross-checks email content and URLs for stronger accuracy.
• Reduces manual email inspection by IT/security teams.
• Labels suspicious emails for immediate awareness.