Introduction
In this article, you will learn about the NordVPN Scam, phishing, and malware protection features, what they do, how they differ, and which devices support them. You will also find a breakdown of all three features that make up Scam, phishing, and malware protection, and how nexos.ai powers its detection capabilities.
NOTE: Previously known as "Threat Protection Pro™," it is now called Scam, phishing, and malware protection. "Threat Protection" is now called Scam and phishing protection. You may still see the old names in some parts of the app while the update rolls out.
Scam, phishing, and malware protection
Scam, phishing, and malware protection is a NordVPN security feature that guards you against a wide range of online threats - without requiring an active VPN connection. It automatically blocks ads, trackers, and malicious URLs, warns you about fraudulent or scam websites with an in-browser alert, scans your downloads for malware, checks your installed apps for security vulnerabilities, and lets you review and manage any quarantined files. Its detection capabilities are powered in part by nexos.ai, NordVPN's AI partner.
The three main parts that protect you from malicious activities are:
- Anti-malware - Scans files for malware upon download, detects double-extension threats, checks apps for vulnerabilities (Windows), and quarantines or auto-deletes malicious files.
- Advanced browsing protection - Blocks malicious websites, displays scam and fraud alerts, detects hijacked session attempts, provides search result safety indicators, offers email protection, and checks crypto wallet addresses.
- Ad and tracker blocker - Blocks ads, blocks trackers, and cleans URLs of tracking parameters.
Scam and phishing protection
Scam and phishing protection is a DNS-based security feature that blocks ads, trackers, and unsafe domains while you are connected to a NordVPN server. Unlike Scam, phishing, and malware protection, it requires an active VPN connection to function and does not include file scanning, quarantine, or app vulnerability checks. (Unless you are using it on Mobile phones. Then you can use it without having an active VPN connection. )
What is the difference between Scam, phishing, and malware protection, and Scam and phishing protection?
The two features serve overlapping but distinct purposes. Here is a summary of the key differences:
| Scam, phishing, and malware protection | Scam and phishing protection | |
|---|---|---|
| VPN connection required? | No | Yes |
| Ad and tracker blocking? | Yes | Yes |
| Malicious URL blocking? | Yes (real-time, in-browser) | Yes (DNS-based) |
| File scanning and quarantine? | Yes | No |
| App vulnerability scanner? | Yes (Windows only) | No |
| Scam and fraud alerts? | Yes | No |
| nexos.ai-powered detection? | Yes | No |
NOTE: Scam and phishing protection uses DNS filtering, which means protection only applies while traffic is routed through a NordVPN server. Scam, phishing, and malware protection operate at the application layer and are always active, regardless of VPN status.
Which devices support each feature?
Scam, phishing, and malware protection are available on:
- Windows 10 (64-bit) and Windows 11
- macOS 12 Monterey and newer - sideloaded app only (not available on the Mac App Store version)
Scam and phishing protection is available on:
- macOS
- Windows
- Android
- iOS
- Linux
- Android TV / Amazon Fire Stick
- NordVPN Chrome Extension
- NordVPN Firefox Extension
- NordVPN Edge Extension
NOTE: Windows and macOS users have access to both features. Android, iOS, Linux, and browser extension users can only use Scam and phishing protection. macOS App Store users do not have access to Scam, phishing, and malware protection - switching to the sideloaded version of the app is required.
What happens when a malicious file is detected?
When Scam, phishing, and malware protection detect a malicious file during a download, it quarantines the file and prompts an in-app notification. From the Protection activity view, you can review the quarantined file and choose one of the following actions:
- Keep file - removes the file from quarantine and marks its status as ALLOWED.
- Delete file - permanently removes the file from your system and marks its status as DELETED.
Quarantined files are automatically deleted after 30 days. If the Auto-delete malicious files toggle is enabled in Advanced settings, files are deleted immediately without being placed in quarantine, and the in-app notification is suppressed.
What is nexos.ai, and how does it relate to this feature?
nexos.ai is NordVPN's AI partner whose technology powers key detection elements within Scam, phishing, and malware protection. This co-branding reflects the integration of AI-driven threat intelligence into the feature's scanning and alerting capabilities.
Additional tips
- Learn how to enable Scam, phishing, and malware protection on macOS.
- Read our guide on the Anti-malware scanner and file quarantine.
- Find out how to resolve Scam, phishing, and malware protection issues on macOS.
- Learn how to switch from the Mac App Store version of NordVPN to the sideloaded version.
