Evilginx

Evilginx: An open-source adversary-in-the-middle phishing framework that relays authentication traffic through a controlled reverse proxy. This can capture not only credentials but also session cookies issued after multi-factor authentication. The tool is used in authorized security assessments but can also be abused for account takeover.

How it works and where it fits

Technically, Evilginx describes an attack path or a concrete method rather than a single suspicious event. A sound assessment separates prerequisites, entry point, objective, intermediate steps, and expected effect. The same technique can produce very different outcomes depending on system architecture, available privileges, exposure, and existing safeguards.

Practical security relevance

In practice, both preventive measures and observable traces matter. Secure configuration, restricted privileges, robust input and identity checks, and telemetry at affected trust boundaries all contribute. A single indicator rarely proves an attack; reliable detection, containment, and remediation require the combined context of timing, source, target, and observed impact.

Related concepts

• Adversary-in-the-MiddleAdversary-in-the-MiddleAn attack in which an actor positions themselves between two communicating parties.: An attack in which an actor positions themselves between two communicating parties.
• PhishingPhishingAttempts to induce users to disclose data or perform malicious actions.: Attempts to induce users to disclose data or perform malicious actions.
• Multi-Factor AuthenticationMulti-Factor AuthenticationRequires at least two independent factors for identity verification.: Requires at least two independent factors for identity verification.
• Session HijackingSession HijackingHijacks a valid user session through the theft or manipulation of session tokens.: Hijacks a valid user session through the theft or manipulation of session tokens.