Phishing Series 2026: Quishing Mobile User-Agent Request to Credential-Harvest URL

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•1

Detects network requests originating from mobile device user-agents to suspected phishing or OAuth-consent URLs. This rule identifies patterns common in 'quishing' (QR-code phishing) campaigns where a mobile device is used to interact with a malicious redirect chain or credential-harvesting page. It excludes known legitimate OAuth authorization flows to reduce noise.