Sophos researchers recently revealed how Evilginx, a malicious version of the open-source NGINX web server, is being used in adversary-in-the-middle (AitM) attacks to steal credentials and authentication tokens. More importantly, this hacking tool can bypass MFA protections.
Evilginx and MFA Bypass Techniques
Evilginx has long been used as an AitM framework to capture user credentials. However, security researchers have now discovered ways to use it for more sophisticated attacks. For instance, last year, Accenture Security researcher Yehuda Smirnov developed a technique to bypass Microsoft’s Windows Hello for Business by downgrading authentication through an Evilginx attack.
Matthew Everts, a senior analyst at Sophos X-Ops’ Incident Response, explained that Evilginx proxies web traffic to malicious domains that spoof legitimate sites like Office 365. The Sophos research team tested Evilginx using Microsoft-themed malicious domains and phishing pages to lure users in.
Users are presented with what looks like an authentic Microsoft 365 login page—complete with legitimate forms and images relayed directly from Microsoft through the Evilginx server.
“On the backend, Evilginx provides attackers with options to configure the user experience. In our testing, we mimicked an account protected by MFA… and promptly bypassed it,” Everts wrote.
Beyond stealing credentials, Evilginx also collects users’ session cookies, allowing attackers to bypass MFA without needing authentication codes. With session cookies and additional data like the user’s IP address, Sophos researchers were able to log into Microsoft’s legitimate portal as the targeted user.
“From here, the threat actor has full access to the user’s mailbox account. Typical actions can include adding mailbox rules,” Everts wrote. “If access is available, the threat actor can also reset MFA devices, change passwords, and perform a number of other actions to maintain persistence in the account.”
How to Detect and Prevent Evilginx Attacks
Enterprise security teams can detect such malicious activity by reviewing Entra ID sign-in and audit logs, which may reveal suspicious connections from unknown IP addresses or the addition of a new authenticator app to a user’s account.
However, by the time these signs appear, the system may already be compromised.
AitM Attacks in the Wild
Sophos recently observed an Evilginx attack against a managed service provider (MSP), which will be detailed in an upcoming report. According to Chet Wisniewski, Global Field CISO at Sophos, there has been an increase in the use of other AitM tools like WikiKit, FlowerStorm, Tycoon2FA, Mambe2FA, and RaccoonO365.
To defend against Evilginx attacks, Everts urged organizations to move away from token-based or push-MFA methods and adopt stronger, phishing-resistant FIDO2-based options like passkeys.
“The good news is that solid options are widely available—Yubikey-type hardware keys, Apple Touch ID on modern hardware, Windows Hello for Business, and even mobile-based authentication using iPhone and Android,” Everts wrote.
Wisniewski added that most threat actors attempt to bypass knowledge-based MFA, such as one-time passwords, SMS codes, or push notifications. However, phishing-resistant MFA like FIDO2 prevents proxy attacks like Evilginx because the authenticator will not accept login requests from an unauthorized domain.
“A combination of FIDO2/passkeys and conditional access policies further strengthens this approach,” he said. “Passkeys are a robust defense against AiTM toolkits like Evilginx.”
As cyberattack techniques evolve, organizations must continuously update their security mechanisms. Simply using MFA is not enough—choosing phishing-resistant authentication methods is crucial to keeping accounts secure.
