Phish Eye

This antivirus module would look at the screen when certain things happen – clicking a link, a new window or system prompt popping up. It might also just check once a second for a few seconds after something new appeared.

It would run character recognition (OCR) on a screenshot. For example if it saw a program that wasn't Firefox drawing the Firefox logo and asking for an admin password to "update," it would know that was a virus. Or if a program typed "G00GLE.COM" (with a zero) in what looked like a URL bar, it'd flag that as a bad link. It would also watch for programs using odd instructions to draw on the screen, trying to obfuscate text or images.

Key to this would be the combination of that OCR from the screenshot with attempted character writes. It would also recognize if a program was trying to draw letter shapes directly instead of just writing text normally. And if characters just appeared on screen without any detectable attempt to write them, there would be a good chance it was malware doing it. If it spotted these kinds of visual tricks, it would throw up an alert about potential scamming, phishing, or malware.

Bonus: a module that identifies the combination of common scammer scripts/screenshot features and remote connections.