diff --git a/options/options.js b/options/options.js
index 6974be0..a24dc1f 100644
--- a/options/options.js
+++ b/options/options.js
@@ -1383,6 +1383,18 @@ class CheckOptions {
this.elements.configDisplay.innerHTML =
'Loading configuration...
';
+ // Try to load from cache first (this reflects what's actually being used)
+ const cacheResult = await chrome.storage.local.get(["detection_rules_cache"]);
+ const cached = cacheResult?.detection_rules_cache;
+
+ if (cached && cached.rules) {
+ // Use cached rules which reflect the actual loaded configuration
+ this.currentConfigData = cached.rules;
+ this.updateConfigDisplay();
+ return;
+ }
+
+ // Fallback to packaged rules if no cache exists
const controller = new AbortController();
const timeoutId = setTimeout(() => controller.abort(), 5000);
@@ -2437,7 +2449,7 @@ class CheckOptions {
cippServerUrl: "",
cippTenantId: "",
customRulesUrl:
- "https://raw.githubusercontent.com/CyberDrain/ProjectX/refs/heads/main/rules/detection-rules.json",
+ "https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/rules/detection-rules.json",
updateInterval: 24,
enableDebugLogging: false,
// Note: enableDeveloperConsoleLogging is not policy-managed - remains under user control
diff --git a/package-lock.json b/package-lock.json
index 32b7389..c038897 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,11 +1,11 @@
{
- "name": "projectx",
+ "name": "Check",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
- "name": "projectx",
+ "name": "Check",
"version": "1.0.0",
"license": "ISC",
"devDependencies": {
diff --git a/package.json b/package.json
index 1fc3f01..f954f1c 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
{
- "name": "projectx",
+ "name": "Check",
"version": "1.0.0",
"description": "An open-source, Manifest V3 browser extension for detecting phishing attacks that impersonate Microsoft 365 sign-in pages.",
"main": "index.js",
diff --git a/rules/detection-rules.json b/rules/detection-rules.json
index 46f448a..a8bdeac 100644
--- a/rules/detection-rules.json
+++ b/rules/detection-rules.json
@@ -1,6 +1,6 @@
{
- "version": "1.0.8",
- "lastUpdated": "2024-12-04T12:00:00Z",
+ "version": "1.1.0",
+ "lastUpdated": "2025-12-20T00:00:00Z",
"description": "Phishing detection logic for identifying phishing attempts targeting Microsoft 365 login pages",
"trusted_login_patterns": [
"^https:\\/\\/login\\.microsoftonline\\.(com|us)$",
@@ -8,32 +8,34 @@
"^https:\\/\\/login\\.microsoft\\.net$",
"^https:\\/\\/login\\.windows\\.net$",
"^https:\\/\\/login\\.partner\\.microsoftonline\\.cn$",
- "^https:\\/\\/login\\.live\\.com$"
+ "^https:\\/\\/login\\.live\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)?ciamlogin\\.com$"
],
"microsoft_domain_patterns": [
- "^https:\\/\\/[^.]*\\.microsoft\\.com$",
- "^https:\\/\\/[^.]*\\.microsoftonline\\.com$",
- "^https:\\/\\/[^.]*\\.office\\.com$",
- "^https:\\/\\/[^.]*\\.office365\\.com$",
- "^https:\\/\\/[^.]*\\.sharepoint\\.com$",
- "^https:\\/\\/[^.]*\\.onedrive\\.com$",
- "^https:\\/\\/[^.]*\\.live\\.com$",
- "^https:\\/\\/[^.]*\\.hotmail\\.com$",
- "^https:\\/\\/[^.]*\\.outlook\\.com$",
- "^https:\\/\\/.*\\.azure\\.(com|cn|net)$",
- "^https:\\/\\/[^.]*\\.azurewebsites\\.net$",
- "^https:\\/\\/[^.]*\\.msauth\\.net$",
- "^https:\\/\\/[^.]*\\.msftauth\\.net$",
- "^https:\\/\\/[^.]*\\.msftauthimages\\.net$",
- "^https:\\/\\/[^.]*\\.msauthimages\\.net$",
- "^https:\\/\\/[^.]*\\.msidentity\\.com$",
- "^https:\\/\\/[^.]*\\.microsoftonline-p\\.com$",
- "^https:\\/\\/[^.]*\\.microsoftazuread-sso\\.com$",
- "^https:\\/\\/[^.]*\\.azureedge\\.net$",
- "^https:\\/\\/[^.]*\\.bing\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*microsoft\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*microsoftonline\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*office\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*office365\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*sharepoint\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*onedrive\\.com$",
+ "^https:\\/\\/live\\.com$",
+ "^https:\\/\\/(?!login\\.)[a-zA-Z0-9-]+(\\.[a-zA-Z0-9-]+)*\\.live\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*hotmail\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*outlook\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*azure\\.(com|cn|net)$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*azurewebsites\\.net$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*msauth\\.net$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*msftauth\\.net$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*msftauthimages\\.net$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*msauthimages\\.net$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*msidentity\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*microsoftonline-p\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*microsoftazuread-sso\\.com$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*azureedge\\.net$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*bing\\.com$",
"^https:\\/\\/github\\.com$",
- "^https:\\/\\/.*\\.cloud\\.microsoft$",
- "^https:\\/\\/([^.]+\\.)*live\\.com(/.*)?$"
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*cloud\\.microsoft$",
+ "^https:\\/\\/([a-zA-Z0-9-]+\\.)*powerbi\\.com$"
],
"exclusion_system": {
"description": "Centralized exclusion system to prevent false positives on legitimate sites (Microsoft partners, SSO providers, major platforms)",
diff --git a/scripts/modules/config-manager.js b/scripts/modules/config-manager.js
index 99f10cb..2627a06 100644
--- a/scripts/modules/config-manager.js
+++ b/scripts/modules/config-manager.js
@@ -108,7 +108,7 @@ export class ConfigManager {
cippServerUrl: "",
cippTenantId: "",
customRulesUrl:
- "https://raw.githubusercontent.com/CyberDrain/ProjectX/refs/heads/main/rules/detection-rules.json",
+ "https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/rules/detection-rules.json",
updateInterval: 24,
enableDebugLogging: false,
// Note: enableDeveloperConsoleLogging is not policy-managed - remains under user control