Kali365 / EvilTokens - Synthetic iOS 18 User-Agent (Version/26.x)
Detects a mismatched/synthetic iOS 18 User-Agent (Version/26.x) used by Kali365 to bypass detection. This specific User-Agent string is indicative of malicious activity as 'Version/26' does not natively exist on iOS 18.
Microsoft Sentinel (KQL)

