Evilginx: The Phishing Toolkit That Made MFA Bypass Point-and-Click
TL;DR:
Evilginx is a free, open-source phishing toolkit that lets attackers impersonate Microsoft login (or Google, or Okta, or Salesforce) and capture both credentials and the session cookie the user gets after MFA.
Think of it like a template for building a fake drive-through window -- pre-built, pre-tested, ready to deploy. Anyone with a cheap server, a lookalike domain, and a few hours can have a working phishing site that looks pixel-perfect.
On a good day, phishing takes real effort, and traditional MFA raises the cost for attackers. On a bad day, Evilginx lowered that cost from "skilled team" to "bored teenager." That's why MITM attacks against Microsoft 365 tenants went from rare to common in the last two years.
Beyond the Basics:
Evilginx is a Go-based reverse proxy phishing framework originally released in 2017 by security researcher Kuba Gretzky as a proof-of-concept, then rewritten as Evilginx2 and Evilginx3. It's free, open source, actively maintained on GitHub -- primarily as a red-team research tool that's been repeatedly weaponized by criminal groups.
In practice, it does four things:
- Proxies the real login page. Microsoft 365, Google Workspace, Salesforce, Okta -- whatever the target is. The victim sees the real page, pixel-for-pixel, because Evilginx is just fetching the real page and passing it through.
- Intercepts credentials and MFA responses. Everything typed into the form gets logged to the attacker's console.
- Captures the session cookie the legitimate identity provider issues after successful authentication. This is the actual prize (see the Token Theft techsplainer).
- Provides "phishlets" -- configuration recipes for specific target sites. The Microsoft 365 phishlet is one of many community-maintained templates. Many work out of the box; others need tuning.
Attacker workflow: register a lookalike domain (login.microsoft365-secure.com or similar), point it at a VPS running Evilginx, send phishing emails that link to the domain, wait for victims. Each click that ends in successful authentication produces a session cookie the attacker can paste into their own browser.
Why it matters for defenders: Evilginx and its copycats -- Muraena, Modlishka, EvilProxy -- made MITM phishing trivially accessible. Before 2020, this attack required custom tooling and expertise. Now a walkthrough exists on YouTube. The volume of AiTM attacks against M365 tenants has climbed accordingly.
What stops Evilginx specifically:
- Phishing-resistant MFA (FIDO2, Windows Hello, passkeys) -- the cryptographic credential refuses to respond to the lookalike domain. No cookie ever gets issued for the attacker to steal. This is the single highest-leverage control.
- Conditional Access with device compliance -- even if credentials get captured, the attacker's machine isn't enrolled in the tenant's MDM. The cookie gets rejected at replay.
- URL filtering and mail security -- Microsoft Defender for Office 365, Mimecast, Abnormal, and Proofpoint flag newly-registered lookalike domains before the phishing email lands. Not perfect, but raises the cost.
The tool is free. The defense isn't complicated. The gap between those two is where attackers are living right now.