From d738f5926f8a71544cd0c2d88e74c3f5d0e71d6e Mon Sep 17 00:00:00 2001 From: Zacgoose <107489668+Zacgoose@users.noreply.github.com> Date: Fri, 3 Jul 2026 00:24:33 +0800 Subject: [PATCH 1/3] Update source URL for rogue apps configuration Signed-off-by: Zacgoose <107489668+Zacgoose@users.noreply.github.com> --- scripts/background.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/background.js b/scripts/background.js index cb22fdc..3182852 100644 --- a/scripts/background.js +++ b/scripts/background.js @@ -66,7 +66,7 @@ class RogueAppsManager { this.defaultConfig = { enabled: true, source_url: - "https://raw.githubusercontent.com/huntresslabs/rogueapps/refs/heads/main/public/rogueapps.json", + "https://huntresslabs.github.io/rogueapps/rogueapps.json", cache_duration: 86400000, // 24 hours update_interval: 43200000, // 12 hours detection_action: "warn", From fa672bfcd98c34483ff50aec94b6a33f5ee1cc90 Mon Sep 17 00:00:00 2001 From: Zacgoose <107489668+Zacgoose@users.noreply.github.com> Date: Wed, 8 Jul 2026 18:16:46 +0800 Subject: [PATCH 2/3] Update detection-rules.json --- rules/detection-rules.json | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index 7fc753c..2a2797c 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -1,6 +1,6 @@ { - "version": "1.2.4", - "lastUpdated": "2026-07-02T00:00:00Z", + "version": "1.2.5", + "lastUpdated": "2026-07-08T00:00:00Z", "description": "Phishing detection logic for identifying phishing attempts targeting Microsoft 365 login pages", "trusted_login_patterns": [ "^https:\\/\\/login\\.microsoftonline\\.(com|us)$", @@ -154,19 +154,22 @@ "type": "any_of", "operations": [ { "type": "substring_present", "values": ["No account? Create one"] }, - { "type": "substring_present", "values": ["Sign-in options"] } + { "type": "substring_present", "values": ["Can't access your account", "Can’t access your account", "Cant access your account"] } ] }, { "type": "any_of", "operations": [ - { "type": "substring_present", "values": ["Can't access your account", "Can’t access your account", "Cant access your account"] }, - { "type": "substring_present", "values": ["Terms of use"] } + { "type": "substring_present", "values": ["Sign-in options"] }, + { "type": "substring_present", "values": ["Email, phone, or Skype"] }, + { "type": "substring_present", "values": ["Stay signed in?"] }, + { "type": "substring_present", "values": ["Use another account"] }, + { "type": "substring_present", "values": ["Pick an account"] } ] } ] }, - "description": "Microsoft login user-visible UX text combo (two or more exact-MS-copy phrases) - durable signal for CSS-clone kits", + "description": "Microsoft login user-visible UX text combo: requires at least one Microsoft-distinctive account/help phrase (exact MS copy: 'No account? Create one' or 'Can't access your account') AND one Microsoft auth-flow phrase ('Sign-in options', 'Email, phone, or Skype', 'Stay signed in?', 'Use another account', 'Pick an account'). Both categories must be MS-distinctive - the generic 'Terms of use' satisfier and the standalone 'Sign-in options' satisfier were removed because non-Microsoft IdP login pages (e.g. Adobe IMS, Trimble Identity) share those exact phrases and were being mis-classified as MS login pages, then blocked by form_post_not_microsoft. Durable signal for CSS-clone kits that copy Microsoft's exact login copy but strip code hooks.", "weight": 3, "category": "primary" }, From b0feea7c0c94bb9f2aa95035769bf86f99e3d5fc Mon Sep 17 00:00:00 2001 From: Zacgoose <107489668+Zacgoose@users.noreply.github.com> Date: Wed, 8 Jul 2026 18:22:14 +0800 Subject: [PATCH 3/3] Update detection-rules.json Signed-off-by: Zacgoose <107489668+Zacgoose@users.noreply.github.com> --- rules/detection-rules.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index 2a2797c..ad01d82 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -169,7 +169,7 @@ } ] }, - "description": "Microsoft login user-visible UX text combo: requires at least one Microsoft-distinctive account/help phrase (exact MS copy: 'No account? Create one' or 'Can't access your account') AND one Microsoft auth-flow phrase ('Sign-in options', 'Email, phone, or Skype', 'Stay signed in?', 'Use another account', 'Pick an account'). Both categories must be MS-distinctive - the generic 'Terms of use' satisfier and the standalone 'Sign-in options' satisfier were removed because non-Microsoft IdP login pages (e.g. Adobe IMS, Trimble Identity) share those exact phrases and were being mis-classified as MS login pages, then blocked by form_post_not_microsoft. Durable signal for CSS-clone kits that copy Microsoft's exact login copy but strip code hooks.", + "description": "Microsoft login user-visible UX text combo: requires at least one Microsoft-distinctive account/help phrase (exact MS copy: 'No account? Create one' or 'Can't access your account') AND one Microsoft auth-flow phrase ('Sign-in options', 'Email, phone, or Skype', 'Stay signed in?', 'Use another account', 'Pick an account').", "weight": 3, "category": "primary" },