EvilGinx

Evilginx is an open-source adversary-in-the-middle phishing framework built on nginx and widely used to proxy legitimate authentication flows in real time. It is commonly deployed against cloud identity providers and webmail services, especially Microsoft 365 and other single sign-on portals, to capture usernames, passwords, multi-factor authentication artifacts, and authenticated session cookies. By relaying the victim’s interaction with the real service through an attacker-controlled reverse proxy, Evilginx enables session hijacking and can allow operators to bypass conventional MFA protections that do not provide phishing resistance.

Evilginx is used extensively in spearphishing and broader phishing operations by both state-linked and financially motivated actors. Reported users include Russian espionage actors such as Star Blizzard and LAUNDRY BEAR, as well as criminal ecosystems and phishing operators associated with Scattered Spider-linked infrastructure and other AiTM campaigns. It has also appeared in modified forks and customized variants that add anti-detection features, target-specific lure themes, cookie handling changes, dashboard functions, and support for additional authentication workflows.

Operationally, Evilginx is typically paired with cloned login pages, lookalike domains, CAPTCHA or anti-bot stages, and social-engineering lures such as conference invitations, procurement workflows, document-sharing prompts, or security alerts. Once a victim authenticates through the proxied page, operators can harvest credentials and replay stolen session material to access accounts, particularly email and cloud services. In observed intrusions, this access has supported espionage, follow-on phishing, mailbox theft, and broader post-compromise activity.

Evilginx is best characterized as a phishing framework and credential-and-session interception utility rather than a traditional endpoint malware family. Its core role is enabling credential theft and session hijacking through AiTM phishing infrastructure targeting web-based authentication flows on Windows-centric enterprise environments and cloud identity ecosystems.