LURE — Browser Phishing Defence Platform

A browser-native phishing defence platform built for SOC teams. 49 real-time detection modules in a Chrome MV3 extension covering the full phishing kill chain — from delivery through credential harvest to persistence — paired with a Python email analysis CLI that produces verdicts from raw .eml files.

The extension ships with a canvas-based live threat visualization dashboard, SOC-ready event export (JSON/CSV), event housekeeping, and a unified domain allowlist (~229 builtin domains) to suppress false positives on trusted sites.

graph TB
    subgraph "Chrome Extension — 49 Detectors"
        SW[Service Worker<br/>Message Router + Triage Engine]
        SW --> D1[Foundation<br/>OAuthGuard · DataEgress · ExtensionAuditor · AgentIntentGuard]
        SW --> D2[Interaction Layer<br/>AutofillGuard · ClipboardDefender · FullscreenGuard<br/>PasskeyGuard · QRLjackingGuard]
        SW --> D3[Social Engineering<br/>WebRTCGuard · ScreenShareGuard · PhishVision<br/>ProxyGuard · SyncGuard · FakeSender]
        SW --> D4[Evasion<br/>CTAPGuard · IPFSGuard · LLMScorer<br/>VNCGuard · PWAGuard · TPASentinel]
        SW --> D5[Exfil + Persistence<br/>DrainerGuard · StyleAuditor · WsExfilGuard<br/>SwGuard · EtherHidingGuard · NotificationGuard]
        SW --> D6[Next-Gen<br/>WebTransportGuard · CanvasPhishGuard<br/>CanvasKeystrokeGuard · CanvasExfilGuard<br/>SpeculationRulesGuard]
        SW --> D7[Anti-Fingerprinting + Payment<br/>StealthKit · ProbeGuard · PaymentRequestGuard]
        SW --> D8[File System + Threat Intel<br/>FileSystemGuard · ThreatIntelSync]
        SW --> D9[SPA + Deepfake Sentinel<br/>SPANavigationMonitor · WebRTCSyntheticTrack]
    end

    subgraph "Allowlist + SOC Tools"
        AL[Unified Allowlist<br/>229 builtin domains · user-editable]
        AL --> CSS[CSS Gate<br/>document_start suppression]
        AL --> TEL_GATE[Telemetry Gate<br/>skip events for trusted domains]
        SW --> EXP[Event Export<br/>JSON · CSV]
        SW --> CLR[Housekeeping<br/>Clear All · Clear >7d]
    end

    subgraph "Lure CLI — Email Analysis Pipeline"
        EML[.eml / .msg] --> PA[Stage A: Parser<br/>SPF · DKIM · DMARC · Routing]
        PA --> PB[Stage B: Extractor<br/>URLs · IPs · Domains · Hashes]
        PB --> PC[Stage C: YARA Scanner<br/>8 custom rules]
        PC --> PE[Stage E: Scorer<br/>11 weighted signals]
        PE --> V{Verdict}
    end

    subgraph "Intelligence Layer"
        SW --> TRI[Triage Engine<br/>NIST 800-61r3 · MITRE ATT&CK]
        SW --> INT[Intelligence Lifecycle<br/>35 PIRs · 31 Correlation Sets]
        SW --> TIS[ThreatIntelSync<br/>PhishStats API · phishnet.cc]
        SW --> TEL[Telemetry<br/>chrome.storage.local]
        TEL --> POP[LURE Dashboard<br/>Canvas Visualization + Events List]
        TEL -.->|Production| DCR[Azure Monitor DCR]
    end

49 detectors, each with additive signal scoring (alert at 0.50, block at 0.70, cap 1.0).

Every detector uses the same additive scoring framework:

• Each signal contributes a weight (0.10–0.40)
• Signals are summed, capped at 1.0
• Severity: >= 0.90 Critical, >= 0.70 High, >= 0.50 Medium
• Action: >= 0.70 blocked (fields disabled, banner injected), >= 0.50 alerted

Example from WebTransportGuard:

Every detection event is enriched by three engines before persistence:

Triage Engine (lib/triage.js) — NIST SP 800-61r3 classification with MITRE ATT&CK mapping, SANS PICERL priority/SLA assignment, and recommended containment actions per event type.

Intelligence Lifecycle (lib/intelligence_lifecycle.js) — 35 Priority Intelligence Requirements (PIRs), confidence scoring, deduplication, 31 correlation sets for campaign grouping, and tactical intelligence summary generation.

ThreatIntelSync (lib/threat_intel_sync.js) — Periodic ingestion from PhishStats API and phishnet.cc feed.txt. Builds compact domain/IP/exfil-endpoint lookup sets stored in chrome.storage.local['threatIntel'], refreshed every 4 hours via chrome.alarms. All lookups are supplementary — core detection quality never degrades if feeds are unreachable.

git clone <repo-url>
cd lur3

# Load in Chrome or Brave:
# 1. Navigate to chrome://extensions (or brave://extensions)
# 2. Enable "Developer mode"
# 3. Click "Load unpacked" → select the extension/ directory

# Extension tests (Vitest) — 1507 tests across 43 suites
cd extension && npm test

# Lure CLI tests (pytest)
cd lure && pip install -e ".[dev,yara]" && pytest -v

The popup renders a live canvas visualization of all detection events. Packets travel along bezier thread paths, color-coded by severity:

• Olive (#8b9e73) — normal / low / medium traffic
• Bronze (#b59a6d) — high severity detections
• Red (#c25e5e) — critical detections with glow

Each threat packet carries a label showing the detector name and key detail (e.g. AiTM Proxy: evilginx.example.com, FS API Credential Exfil: .aws, .env).

• Recent Events List — clickable rows with severity chips; expand any event to see full detail
• Event Export — download all events as JSON (with metadata bundle) or CSV (RFC 4180)
• Housekeeping — Clear All or Clear events older than 7 days
• Allowlist Editor — add/remove custom domains from the user allowlist directly in the popup

Two-layer false-positive suppression for trusted domains:

1. CSS Gate (allowlist_gate.js) — runs at document_start before all detectors. Injects a single CSS rule [id^="phishops-"] { display: none !important } to hide all PhishOps banners on allowlisted domains. Zero existing detectors need modification.

2. Telemetry Gate — emitTriagedTelemetry() in the service worker extracts the hostname from each event's URL and skips emission for allowlisted domains, keeping storage and badge counts clean.

Builtin list: ~229 domains merged from all detector-specific trusted domain lists, the top-500 most-trafficked websites, and false-positive events observed in field testing. Covers Google, Microsoft, Amazon, major news/social/shopping/education sites, auth providers, and security platforms.

User list: stored in chrome.storage.local['phishops_user_allowlist'], editable via the popup. Subdomain matching is automatic — adding corp.com covers app.corp.com.

Email analysis pipeline producing categorical verdicts from raw .eml files.

lur3/
├── extension/                  # Chrome MV3 extension
│   ├── manifest.json           # v1.0.0, 49 detectors, alarms permission
│   ├── background/             # Service worker (message routing + triage + allowlist gate)
│   ├── content/                # 41 content scripts (incl. allowlist_gate.js)
│   ├── lib/                    # triage.js · intelligence_lifecycle.js · telemetry.js
│   │                           # stealth_kit.js · threat_intel_sync.js
│   │                           # allowlist.js · event_export.js
│   ├── popup/                  # LURE dashboard (canvas viz + events list + allowlist editor)
│   └── tests/                  # 43 Vitest test files, 1507 tests
│
├── lure/                       # Email analysis CLI
│   ├── lure/modules/           # parser, extractor, scanner, scorer
│   ├── rules/                  # YARA rule files
│   └── tests/                  # pytest tests
│
├── Research/                   # Threat research and detector design docs
├── Plans/                      # Architecture and implementation planning docs
├── CUTTING_EDGE_DETECTORS.md   # Next-gen detection candidates
├── RESEARCH_PROMPTS.md         # Structured research prompts
└── THREAT_INTELLIGENCE.md      # Detector → threat intel source mapping

See THREAT_INTELLIGENCE.md for the complete mapping of every detector to its primary threat intelligence source.

See CUTTING_EDGE_DETECTORS.md for research on next-generation detection candidates.

• Azure Monitor DCR integration — requires infrastructure. Telemetry architecture is documented; local storage stub demonstrates the full pipeline.
• Chrome Web Store publication — sideload is sufficient for review.
• Favicon hash map populated — FAVICON_HASH_TO_BRAND in PhishVision ships empty. Infrastructure is complete; hashes are collected operationally using the DevTools script in the source comments.
• urlscan.io reactive enrichment — Tier 2 integration (requires API key). Architecture designed; deferred per design constraints.