Loading malware…
Evilginx2 is an open-source adversary-in-the-middle phishing framework that uses a reverse proxy to intercept authentication traffic between victims and legitimate websites. It captures login credentials, one-time authentication codes, and authenticated session cookies in real time. Attackers can replay captured cookies to hijack sessions without repeating authentication, bypassing MFA methods that do not cryptographically bind authentication to the legitimate website origin. Evilginx2 is a phishing framework rather than an endpoint malware implant.
Service-specific configurations known as phishlets enable impersonation of authentication flows for services including Microsoft 365, Google, AWS, and GitHub. Victims are directed to attacker-controlled phishing sites that relay traffic to the legitimate service. The framework can route traffic through SOCKS5 and HTTP(S) proxies. Its targets include cloud identity systems, email accounts, and other authenticated web applications, without requiring compromise of the victim's operating system.
Evilginx2 has been used by ALPHV/BlackCat affiliates and is associated with Qilin campaigns and the Russian espionage group Star Blizzard, also known as COLDRIVER and IRON FRONTIER. It also forms the basis of derivative phishing-as-a-service offerings, including BigBear 2.0. Capabilities added by such derivatives are not necessarily features of the original framework.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BigBear 2.0 is described as a rebranded Evilginx2-based phishing-as-a-service framework. Evilginx2 phishlets operate as adversary-in-the-middle proxies that capture credential submissions and session cookies during Microsoft 365 authentication.
"...with the help of an Adversary-in-the-Middle (AitM) toolkit like EvilGinx2, could quickly provision most of the necessary infrastructure to perpetrate an attack..."
"...with the help of an Adversary-in-the-Middle (AitM) toolkit like EvilGinx2, could quickly provision most of the necessary infrastructure to perpetrate an attack..."
"...with the help of an Adversary-in-the-Middle (AitM) toolkit like EvilGinx2, could quickly provision most of the necessary infrastructure to perpetrate an attack..."
"...with the help of an Adversary-in-the-Middle (AitM) toolkit like EvilGinx2, could quickly provision most of the necessary infrastructure to perpetrate an attack..."
"...with the help of an Adversary-in-the-Middle (AitM) toolkit like EvilGinx2, could quickly provision most of the necessary infrastructure to perpetrate an attack..."
+2 more in the app. View in Mallory
16 distinct techniques documented for this family, organized by ATT&CK tactic.
BigBear 2.0 ... opération de phishing-as-a-service (PhaaS) basée sur le framework Evilginx2.
“...automated cookie replay ... to bypass MFA” and “474 MFA-bypassed authentications.”
“BigBear 2.0 is a rebranded Evilginx2-based Phishing-as-a-Service (PhaaS) framework targeting Microsoft 365 accounts...”
BigBear 2.0 est une plateforme PhaaS ... ciblant exclusivement Microsoft 365 / Azure AD (Entra ID) via la technique Adversary-in-the-Middle (AiTM).
“...automated cookie replay ... to bypass MFA” and “474 MFA-bypassed authentications.”
“...automated cookie replay ... to bypass MFA” and “474 MFA-bypassed authentications.”
“The multi-tenant infrastructure remained active while operators began deleting VPS nodes, indicating counter-forensic activity.”
“...automated cookie replay ... to bypass MFA” and “474 MFA-bypassed authentications.”
“Another check attempts to block visitors arriving from datacenter, VPN, and proxy addresses, making life harder for automated scanners and researchers.”
Injections JavaScript personnalisées ... Désactivation de FIDO2/WebAuthn ... Blocage de la télémétrie anti-phishing Microsoft (events.data.microsoft.com, OneCollector).
“The operation exfiltrated 5,137 credential records, including ... 1,032 plaintext passwords...”
“The operation exfiltrated ... 4,148 session cookies” and used “automated cookie replay.”
“BigBear 2.0 is a rebranded Evilginx2-based Phishing-as-a-Service (PhaaS) framework targeting Microsoft 365 accounts and using AiTM phishing... to bypass MFA.”
“Its Evilginx2 infrastructure operates as an adversary-in-the-middle proxy between the victim and Microsoft's real login service.”
“Another check attempts to block visitors arriving from datacenter, VPN, and proxy addresses, making life harder for automated scanners and researchers.”
474 authentifications complètes avec contournement MFA ... API REST (/api/jobs) pour le replay automatisé de cookies.
“The operation exfiltrated 5,137 credential records, including ... 1,032 plaintext passwords...”
“BigBear 2.0 is a rebranded Evilginx2-based Phishing-as-a-Service (PhaaS) framework targeting Microsoft 365 accounts and using AiTM phishing... to bypass MFA.”
“Its Evilginx2 infrastructure operates as an adversary-in-the-middle proxy between the victim and Microsoft's real login service.”
“...using AiTM phishing, automated cookie replay, residential proxies, and Telegram-based credential exfiltration...”
“BigBear used country-matched residential proxies.”
69 proxies résidentiels géo-matchés par pays pour contourner la détection d’anomalies géographiques de Microsoft.
“...Telegram-based credential exfiltration...”
108 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.