EvilginxMalware
According to the author, Evilginx is a standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.From MISP Galaxy
Last reported 19 days ago, by The Hacker News14 reports
ATT&CK techniques
6 of 22 · each with the sentence it comes from- T1684Social Engineering
“…overhauls their TTPs to avoid detection, often in response to public exposure of the actor’s campaigns that have involved targeted social engineering through messaging apps and credential theft.”
- T1053.005Scheduled Task
“The end goal is to deploy a custom backdoor called CosmicPulse by setting up scheduled tasks using RedFlick through phishing emails masquerading as invitations.”
- T1021.001Remote Desktop Protocol
“MFA might be a small, inconvenient step for a user, but the aftermath of a compromised Remote Desktop Protocol (RDP) or VPN because MFA wasn’t enabled is a much bigger inconvenience for the entire business.”
- T1036Masquerading
“The end goal is to deploy a custom backdoor called CosmicPulse by setting up scheduled tasks using RedFlick through phishing emails masquerading as invitations.”
- T1110.004Credential Stuffing
“Credential stuffing and ghost logins”
- T1176.001Browser Extensions
“Malicious browser extensions”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
14 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests“…ropic admitted self-reflectively that the lack of guardrails may actually be benefiting the defenders working to secure their systems," Evilginx creator Kuba Gretzky said in an X post.”
-
Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing“It’s built on open source Frameless BitB, which contains a Browser-in-the-Browser (BitB) overlay, an Evilginx phishlet to intercept usernames, passwords, and session cookies for Microsoft 365, and server-side substitution rules that inject the kit into proxied pages.”
-
Know Your Enemy: Browser-Based Attack Techniques in 2026“Reverse-proxy adversary-in-the-middle (AiTM) kits like Tycoon2FA, Sneaky2FA, and Evilginx relay credentials and session tokens in real time, bypassing most forms of MFA.”
-
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor“The group still runs password phishing with Evilginx, a tool that can also steal session cookies to get around two-factor authentication.”
-
Star Blizzard refines phishing and malware delivery with the RedFlick technique“Star Blizzard also continues using email from free providers such as Proton @proton.me, particularly in Evilginx spear-phishing operations observed throughout 2026.”
-
French NGO reporters without borders targeted by Calisto“It appears to be a homemade kit, as we were unable to link any atomic indicators to known frameworks such as Evilginx.”
-
Global analysis of Adversary-in-the-Middle phishing threats“According to this methodology, the most widespread phishing kits are Tycoon 2FA, Storm-1167, NakedPages, Sneaky 2FA, EvilProxy, and Evilginx.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“…on Sekoia data, the most prevalent phishing-related threats as of early 2025 include Tycoon 2FA, NakedPages, Sneaky 2FA, Storm-1167 and Evilginx.”
-
MFA for Business: Benefits, Methods & Why It Still Matters“The use of Evilginx and Adversary-in-the-Middle (AiTM) attacks”
-
An Attacker’s Blunder Gave Us a Look Into Their Operations“… campaigns and starting a trial— giving us a sprawling inside look at how they’re using AI to build workflows, searching for tools like Evilginx, and more.”
-
To MFA or Not To MFA“Evilginx is the most well known of these AiTM toolkits, but many Phishing-as-a-Service kits like NakedPages and Evilproxy perform similar attacks every day against the SMB.”
-
Inside Adversary-in-the-Middle Attacks“Evilginx is the best-known AiTM toolkit, but many Phishing-as-a-Service (PhaaS) platforms, such as NakedPages and Evilproxy, carry out similar attacks daily against small and medium-sized businesses (SMBs).”
-
Phishing in the Fast Lane“From using landing page delay to leveraging MFA capture with programs like Evilginx, this lightning round of demos serves as a cautionary tale for organizations navigating reduced cybersecurity budgets in a world chock-full of evolving attack methods.”
-
Smuggler’s Gambit“We can confidently rule out Evilginx, however, due to the differences in the lure pattern, URL parameter pattern, and existence of keyed payload HTML files.”
Indicators in its reports
named in the reports above- 103.160.59[.]97in 2 reports
- secure-dns-hub[.]comin 2 reports
Copy these 2 indicators · defanged
Thanks — we review every report.