Log in Request a demo

Malware profile

Evilginx

Also known as evilginx2, EvilGinx

Evilginx is a free, open source toolkit that sits between a victim and a real website and copies what passes through, including passwords and login session cookies.

In short

Evilginx is a free, open source toolkit that sits between a victim and a real website and copies what passes through, including passwords and login session cookies. It was built for security testing, but attackers also use it to take over accounts and get around multifactor authentication that is not phishing resistant. MITRE tracks it as evilginx2.

Last updated 9 October 2026

Profile MapMalware
  1. Names3names in public reportsEvilginx · evilginx2 · EvilGinx
  2. Techniques14ATT&CK techniques listedCredential Access · Collection · Command and Control
  3. Infection Steps4in the delivery chainLure · Sign-in
  4. Linked Groups1groups that use itLAUNDRY BEAR

In one minute

What it is
An open source adversary-in-the-middle phishing toolkit, made for security testing and misused by attackers.
What it does
Acts as a relay between a victim and a real login page, and captures passwords, authentication tokens and session cookies, so non-phishing-resistant multifactor authentication does not stop the attacker.
Who uses it
Named by CISA (advisory AA26-204A, 23 July 2026) as used in a modified form by LAUNDRY BEAR, a group attributed by the AIVD and MIVD (publication of 27 May 2025). CISA also names it for ALPHV Blackcat affiliates (AA23-353A) and Star Blizzard (AA23-341A). MITRE lists no group.
How it gets in
A phishing link that leads the victim to a fake sign-in page which relays the real one.
What to do first
Move users, and administrators first, to phishing-resistant multifactor authentication such as FIDO2 security keys or passkeys.

What it does

Evilginx is a legitimate security-testing tool that attackers misuse. MITRE describes it as an open-source adversary-in-the-middle framework built on the nginx web server. It acts as a reverse proxy: the victim talks to the attacker server, which passes everything to the real login page and back, so the victim sees a normal sign-in.

Because the real site completes the login, the tool can keep the session cookie that proves the user is signed in. With that cookie an attacker can use the account without the password or the second factor. Tools like this get around multifactor methods that are not phishing resistant.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
EvilginxPage title. CISA advisory AA26-204A uses this spelling for the modified version[2]
evilginx2MITRE ATT&CK software S9003, and CISA advisories AA26-204A and AA23-353A (as Evilginx2)[1, 2, 3]
EvilGinxSpelling used in CISA advisory AA23-341A[4]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Credential Access

  • Adversary-in-the-Middle T1557

    It relays traffic between a phished user and the real website and captures usernames, passwords, authentication tokens and session cookies.[1, 2]

  • Multi-Factor Authentication Interception T1111

    It captures authentication tokens, which lets the attacker get past forms of multifactor authentication that are not phishing resistant.[1, 5]

  • Steal Web Session Cookie T1539

    It records each victim session, including the session cookie.[1, 4]

Collection

  • Browser Session Hijacking T1185

    It can add its own POST arguments to requests so that "Remember Me" is switched on quietly and the login stays valid across browser sessions.[1]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    It proxies the HTTPS connections between victims and the sites they think they are visiting.[1]

  • Proxy: External Proxy T1090.002

    It can send traffic through SOCKS5 and HTTP(S) proxies between the victim and the real website.[1]

  • Data Obfuscation T1001

    It changes the Origin and Referrer fields in the HTTPS headers it relays so that cross-origin rules are met.[1]

  • Data Encoding T1132

    It can create random parameters, Base64 encoded, in phishing links to get past static detection.[1]

Execution

  • Command and Scripting Interpreter: JavaScript T1059.007

    It can inject JavaScript into the page content to adjust a phishing attack.[1]

Stealth

  • Execution Guardrails T1480

    It can refuse requests to a phishing URL when the visitor User-Agent does not match an allowlist filter set for that lure.[1]

  • Virtualization/Sandbox Evasion: Time Based Checks T1497.003

    It can hide phishing lures for a set time to avoid scanning by sandboxes.[1]

Defense Impairment

  • Subvert Trust Controls: Install Root Certificate T1553.004

    It has obtained a valid certificate from Let's Encrypt to answer ACME challenges.[1]

Discovery

  • System Network Configuration Discovery T1016

    It records the public IP address and user agent of each victim session.[1]

Reconnaissance

  • Phishing for Information: Spearphishing Link T1598.003

    It can create and show phishing URLs with hidden tracking pixels and can place URLs in frames for browser-in-the-browser phishing.[1]

How it spreads

The sources do not describe Evilginx as spreading by itself. It is run by an operator who sends a lure. MITRE says it can generate phishing links, including links placed in frames for browser-in-the-browser phishing. In AA26-204A, CISA describes social engineering that led targets to a fake site posing as a European Defence and Security Summit registration portal, where they were asked to sign in with their Microsoft account.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Lure

    In a case CISA dates to April 2025, LAUNDRY BEAR used social engineering to lead targets to a malicious site that looked like a European Defence and Security Summit registration portal.[2]

  2. Sign-in

    The portal asked registrants to sign in with a Microsoft account to view it.[2]

  3. Interception

    When the user entered Microsoft credentials, the modified version of Evilginx used by LAUNDRY BEAR intercepted them. CISA calls this an adversary-in-the-middle technique.[2]

  4. Account access

    LAUNDRY BEAR used the passwords and session tokens to reach the account and run mass email exfiltration.[2]

Timeline

  1. 7 December 2023

    CISA advisory names EvilGinx

    Advisory AA23-341A says Star Blizzard uses EvilGinx in spearphishing to harvest credentials and session cookies.[4]

  2. 15 December 2023

    CISA risk assessment advisory

    Advisory AA23-349A notes that tools like Evilginx can bypass MFA that is not phishing resistant.[5]

  3. 27 February 2024

    ALPHV Blackcat advisory last revised

    CISA advisory AA23-353A states that ALPHV Blackcat affiliates use Evilginx2 for MFA credentials, login credentials and session cookies.[3]

  4. April 2025

    Fake event portal

    CISA says that as of April 2025 a LAUNDRY BEAR site resembled a European Defence and Security Summit registration portal and intercepted Microsoft credentials with a modified Evilginx.[2]

  5. 27 May 2025

    AIVD and MIVD publication on LAUNDRY BEAR

    The Dutch NCSC reports the AIVD and MIVD publication on the Russian actor LAUNDRY BEAR.[6]

  6. 23 July 2026

    CISA advisory AA26-204A

    CISA and partners publish an advisory on LAUNDRY BEAR and name Evilginx2 among open source tools the group used in previous campaigns.[2]

Detection and defense

  1. Use phishing-resistant MFA

    CISA recommends FIDO/WebAuthn or PKI-based MFA, which resist phishing. The Canadian Cyber Centre says phishing-resistant MFA can prevent AitM campaigns and asks for it for every user, administrators first. The Dutch NCSC, in its note on the AIVD and MIVD publication, also advises phishing-resistant MFA.[3, 6]

    Counters: T1557 T1111 T1539

  2. Limit and rebind session cookies

    The Dutch NCSC advises that each session cookie works from one IP address only, and short cookie lifetimes, which makes a stolen cookie hard to use.[6]

    Counters: T1539

  3. Watch for sign-ins from VPN providers

    CISA advises watching for connections to internal services such as webmail from VPN providers the group often uses, with logging that lets you see it.[2]

    Counters: T1557

  4. Disable mail forwarding

    CISA and the NCSC advise disabling mail forwarding, or checking regularly for forwarding rules an outsider has set up to keep seeing mail.[4]

    Counters: T1539

  5. Train users on phishing

    CISA recommends regular training so users spot and report suspicious emails and links, and the NCSC advises checking whether a message can be verified another way.[3, 4]

    Counters: T1598.003

  6. Use official detection resources

    CISA advisory AA26-204A carries indicators for the LAUNDRY BEAR Zimbra activity, with a note that they are for historic attribution. They are for that campaign, not for Evilginx itself, which any operator can run.[2]

    Counters: T1557

Questions

What is Evilginx?

MITRE describes evilginx2 as an open-source adversary-in-the-middle attack framework based on the nginx web server. It can act as a reverse proxy between victims and real web services to capture credentials, authentication tokens and session cookies.

Is Evilginx malware?

Not by itself. It is an open source security-testing tool, and MITRE lists it as a tool. Attackers misuse it, and CISA names actors that did.

Does MFA stop Evilginx?

Not every kind. MITRE says it can intercept tokens to bypass non-phishing-resistant MFA. CISA recommends FIDO/WebAuthn or PKI-based MFA, which resist phishing.

Who uses Evilginx?

CISA names ALPHV Blackcat affiliates (AA23-353A), Star Blizzard (AA23-341A) and LAUNDRY BEAR with a modified version (AA26-204A). MITRE lists no group for it.

Was Evilginx used in the Zimbra campaign?

No source says so. AA26-204A describes the Zimbra attack as a view-based exploit and says Evilginx2 was used in previous campaigns by the same group.

In our research

  1. Phishing-as-a-Service 2.0: The Kits That Bypass MFA Without a Fake Login Page August 2026
  2. A New AiTM Phishing Campaign Targeting Institution/Organization Personnel Has Been Detected August 2022
  3. LAUNDRY BEAR Threat group
  4. Star Blizzard Threat group

Sources

  1. evilginx2, Software S9003 MITRE ATT&CKSupports: Description, platforms, techniques and how it intercepts credentials and session cookies.
  2. Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite (AA26-204A) CISASupports: LAUNDRY BEAR use of a modified Evilginx and Evilginx2 in previous campaigns.
  3. Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spearphishing Campaigns (AA23-341A) CISASupports: Star Blizzard use of EvilGinx and the mitigations.
  4. Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment (AA23-349A) CISASupports: Evilginx can bypass non-phishing-resistant MFA.
  5. Publicatie van AIVD en MIVD over Laundry Bear NCSC-NL (Dutch)Supports: News item of 27 May 2025 on the AIVD and MIVD publication, with advice on phishing-resistant MFA and session cookies.
  6. Defending against adversary-in-the-middle threats with phishing-resistant multi-factor authentication (ITSM.30.031) Canadian Centre for Cyber SecuritySupports: Phishing-resistant MFA as the answer to AitM phishing.

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Star Blizzard

Attributed by the UK, US, Australian, Canadian and New Zealand governments to Russia's Federal Security Service (FSB) Center 18, this group is linked to long phishing campaigns against politicians, researchers, journalists and government staff in the UK, US and other NATO countries. It steals email logins and reads the victims' mail.

Read more

Glossary term

Session cookie

A session cookie is a small piece of data a website stores in your browser to recognize you after you sign in.

Read more