alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING DeviceCode Phishing Landing Page Observed"; flow:established,to_client; http.response_body; content:"exclusive|20|Copilot|20|features|20|built"; content:"Follow|20|the|20|link|20|below|20|and|20|enter|20|the|20|code|3a|"; fast_pattern; classtype:social-engineering; sid:2069030; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_04_27, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Critical, updated_at 2026_05_01; target:dest_ip;)