TOKYOCORE possible connectivity check to google.com using bare Mozilla/5.0 User-Agent

Duo Tech@duotech

•updated Jul 27, 2026•0•0•5

Detects outbound HTTP GET requests to google.com that utilize a bare 'Mozilla/5.0' User-Agent header, which is indicative of the TOKYOCORE malware performing network connectivity checks. This behavior is atypical for standard browsers and can be used to identify potential beaconing activity.