Dice.camp

0 posts0 participants0 posts today

Christoffer S.(sophos.com) Evilginx: How Attackers Bypass MFA Through Adversary-in-the-Middle Attacks <a href="https://news.sophos.com/en-us/2025/03/28/stealing-user-credentials-with-evilginx/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://news.sophos.com/en-us/2025/03/28/stealing-user-credentials-with-evilginx/</a>A short descriptive article about Evilginx and how stealing credentials work, a few suggested ways of detecting etc.Summary: This article examines Evilginx, a tool that leverages the legitimate nginx web server to conduct Adversary-in-the-Middle (AitM) attacks that can bypass multifactor authentication (MFA). The tool works by proxying web traffic through malicious sites that mimic legitimate services like Microsoft 365, capturing not only usernames and passwords but also session tokens. The article demonstrates how Evilginx operates, showing how attackers can gain full access to a user's account even when protected by MFA. It provides detection methods through Azure/Microsoft 365 logs and suggests both preemptive and reactive mitigations, emphasizing the need to move toward phishing-resistant FIDO2-based authentication methods.<a href="https://swecyb.com/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://swecyb.com/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> <a href="https://swecyb.com/tags/Evilginx" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Evilginx</a> <a href="https://swecyb.com/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://swecyb.com/tags/Credentials" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Credentials</a> <a href="https://swecyb.com/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MFA</a> <a href="https://swecyb.com/tags/Azure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Azure</a> <a href="https://swecyb.com/tags/Sophos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Sophos</a>

Erik van Straten2FA (MFA) beschermt *niet* tegen steeds meer phishingaanvallen:<<<Tycoon 2FA operates as an adversary-in-the-middle (AitM) phishing kit. Its primary function is to harvest Microsoft 365 and Gmail session cookies. >>> <a href="https://www.proofpoint.com/us/blog/email-and-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.proofpoint.com/us/blog/email-and-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass</a>U kunt zichzelf hier prima tegen beschermen, zonder passkeys of software van bijvoorbeeld Proofpoint te gebruiken: zie <a href="https://security.nl/posting/841126" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://security.nl/posting/841126</a><a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passkeys</a> <a href="https://infosec.exchange/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PasswordManager</a> <a href="https://infosec.exchange/tags/Passwords" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passwords</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PhaaS</a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EvilProxy</a> <a href="https://infosec.exchange/tags/EvilGinx" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EvilGinx</a> <a href="https://infosec.exchange/tags/EvilGinx2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EvilGinx2</a> <a href="https://infosec.exchange/tags/Tycoon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tycoon</a> <a href="https://infosec.exchange/tags/Proofpoint" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Proofpoint</a>

Chrisis <a href="https://chaos.social/tags/evilginx" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#evilginx</a> still a thing to phish outlook.com credentials / token? <a href="https://chaos.social/tags/evilginx2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#evilginx2</a>

Eric Woodruff [MS MVP] :donor:For anyone at <a href="https://infosec.exchange/@BlueTeamCon" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@BlueTeamCon</a> who wants to understand why many forms of MFA are not phishing-resistant and why passkeys/FIDO2 are, tomorrow at 12:20pm during lunch in the <a href="https://infosec.exchange/tags/unconference" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unconference</a> room I’ll be delivering an impromptu session on <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> resistant authentication, including a live demo of <a href="https://infosec.exchange/tags/evilginx" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#evilginx</a>.<a href="https://infosec.exchange/tags/BlueTeamCon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BlueTeamCon</a> <a href="https://infosec.exchange/tags/BlueTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BlueTeam</a> <a href="https://infosec.exchange/tags/blueteamcon2023" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blueteamcon2023</a> <a href="https://infosec.exchange/tags/mvpbuzz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mvpbuzz</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

Recent searches

Search options

Administered by:

Server stats:

#evilginx