ctrlINT What the industry said about every indicator, with the quote

evilginx2Tool

evilginx2 is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. evilginx2 can be used as a reverse proxy between victims and legitimate web services to intercept and capture credentials, authentication tokens, and session cookies.From MITRE ATT&CK

Last reported 1 month ago, by Infosecurity Magazine2 reports

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1555.005Password Managers

    ““IT staff also often have privileged access to Azure AD, on-prem AD, RMM tools and password managers.””

    Infosecurity MagazineNews
  2. T1556.009Conditional Access Policies

    “Strengthen conditional access policies and compliant-device requirements”

    Infosecurity MagazineNews

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “Bigbear 2.0 is based on adversary-in-the-middle framework Evilginx2, according to CloudSEK.”

    Infosecurity MagazineNews
    BigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials

  2. “Interestingly, some Sneaky 2FA domains were previously associated with known AiTM phishing kits, such as evilginx2 and Greatness, according to our Sekoia C2 trackers.”

    Sekoia.ioVendor
    Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with evilginx2 here?
No account needed. We do not store your IP address.