Kali365 / EvilTokens - Linux Chrome Leaking Server OS

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•10

Detects Railway server OS leaking via User-Agent during automated token exchanges. This rule specifically looks for sign-in logs where the User-Agent string indicates a Linux x86_64 system and a Chrome browser version 145 or 146.