Suspicious Authentication via Synthetic iOS Safari User Agent

Tim Peck@timpeck

•updated Mar 24, 2026•6•0•199

Detects authentication attempts utilizing a specific synthetic mobile user agent (iOS 18 paired with Safari Version/26.x) observed in the EvilTokens device code phishing campaign. Version 26 does not exist on iOS 18.