TL;DR: The beloved VirusTotal (VT) Browser Extension has evolved. We are excited to introduce the new Google Threat Intelligence browser extension, a powerful upgrade for enterprise security teams. This new extension integrates Google Threat Intelligence—combining Mandiant's frontline expertise with VirusTotal's vast data and core Google insights —directly into your browser. It empowers analysts with immediate threat context & triage, investigate in-depth without context switching and seamless collaboration & tracking to stay on top of threats, all by providing actionable Threat Intelligence directly within your browser. The Analyst's Bottleneck: Too Many Tabs, Not Enough Context For security analysts, incident responders, and threat researchers, the web browser is the workbench. You live in it—constantly triaging alerts in a SIEM, tracking campaigns in case management tools, or reading new threat reports.The main obstacle has always been the massive operationalization overhead. Every time you encounter an Indicator of Compromise (IoC), you're forced to copy, paste, and pivot to a different platform to find out what it is and if it matters to your organization. This context-switching is a major drain on time and focus.Threat Intel Where You Work The Google Threat Intelligence browser extension bridges this gap. It's a stack-agnostic tool designed to feel like a native feature inside your existing security solutions.Building on the foundation of the 100,000-user-strong VT extension, this upgrade delivers actionable threat intelligence at Google scale, precisely where you need it. The extension automatically detects IoCs (hashes, domains, IPs, and URLs) on any webpage and enriches them in place.This is all powered by Google Threat Intelligence, which unifies insights from Mandiant's frontline experts, the vast VirusTotal community ecosystem, and Google's own global threat visibility into a single, powerful tool.Key Features for Enterprise Analysts 1. Instant Triage and PrioritizationTransform IoCs on any page into actionable intelligence.Automated IoC Detection: The extension automatically highlights all visible IoCs (IP, DNS, URL, Hash) on the page, updating continuously as you scroll. At-a-Glance Detection Ratio: A Detection Ratio / Score appears directly next to each IoC, providing an immediate visual triage point to help you prioritize. Quick-View Hovercards: Simply hover over the Detection Ratio of any enriched IoC to see a "Hovercard" with essential details: the Google Threat Intelligence Verdict, Severity and Score, a concise Google Threat Intelligence Assessment, and the detection ratio (number of security vendors that have flagged the IoC as malicious). 2. In-Depth Investigation Without the Context SwitchWhen an IoC looks suspicious, you can dig deeper without opening a new tab.Detailed IoC Report: Click the Detection Ratio of any IoC to open the Google Threat Intelligence Widget directly in a side panel. This panel delivers the full, detailed attribution and reputation context for the IoC, right within your original workflow. 3. Seamless Collaboration and TrackingYou can easily share the IoCs with your colleagues to drive collaboration and future tracking to continue to keep you safe.Comprehensive Page Summary: Click “View Summary of all IoCs” on the extension pop-up in your browser toolbar to generate a "Page View Summary." This opens a single page in the Google Threat Intelligence platform that summarizes the reputation and key context for all IoCs visible on your current webpage. Export to IoC Collections: From the Page View Summary, you can select specific IoCs and export them directly into a new IoC collection within Google Threat Intelligence. Manage the IoC collection as a persistent object to add IoCs from other webpages and workflows. Investigate deeper to understand the Mitre ATT&CK Tactic, Techniques, Procedures (TTPs), what detection rules have matched against the IoCs and the Community comments. Share with your colleagues for collaboration, you can also choose to make a collection public to enable immediate, valuable context to other researchers and might be the missing piece to link disparate threat attacks, or attribute activity to a specific threat actor. You can also convert it to an IoC stream to ingest into any SIEM to detect and investigate if your organization is impacted by the IoCs. You can add a IoC collection to your desired Threat Profile in Google Threat Intelligence to understand its relevance and frequency to your organization. 4. Proactive Download Protection: Building on its VirusTotal heritage, the extension scans files before they download. You can choose to proceed or cancel the download based on the scan results, protecting you from malicious files. Two Tiers of Intelligence: For EveryoneThis evolution serves both our VirusTotal community and our enterprise Google Threat Intelligence customers.For Google Threat Intelligence Users: By using your Google Threat Intelligence API key, you get all the features listed above, and seamless integration with the Google Threat Intelligence platform. For VirusTotal Users: You can continue to use the extension with a VT API key. You will still get IoC highlighting & enrichment and find the community-level information through VT Augment Widget. How to Get StartedThe Google Threat Intelligence browser extension is available now for Chrome, Firefox, and Edge.Install it today to transform unparalleled intelligence into decisive action. Please be sure to check out a brief video tour of the extension and consult the documentation for setup instructions and to review the Extension settings. We Want Your FeedbackThis is just the beginning. We are committed to ensuring future functionality meets your needs. Please share your feedback and contribute your suggestions for what you'd like to see in the next release!AcknowledgementSpecial thanks to the following people for playing a key part in this launch: AnaTinoco, Sukeerth Reddy, Camilo Andres Benito Rojas, Angela Dini, Emiliano Martinez, Bien Nguyen.
