Evilginx2: Phishing toolkit designed for MFA bypass gets an update

Evilginx2 is an open source tool available on Github designed for acting as a man-in-the-middle webserver to phish for credentials, OTP/MFA tokens and session cookies from victims. The tool has been designed for ease of configuration, which makes it easy for unskilled threat actors to set up phishing pages targeting popular brands and companies. On September 14th, 2020, Evilginx2 received its first update in over a year and a half, bringing fresh eyes and attention to the tool. The latest updates provide cybercriminals who use Evilginx2 to create customized lure pages, proxy support, IP blacklisting and custom URL support.There is evidence of actors advertising phishing pages on Evilginx2 Github in exchange for money. Alpha Team assesses it is probable that Evilginx2 has and will be used more for malicious intent.

Recommendations

Where possible, use conditional or risk based access policies to restrict MFA authentication to specific geo-locations
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

Unlike other phishing kits which phish for MFA or OTP codes and exfiltrate to Telegram, email or log files, Evilginx2 proxies the session via the attacker controlled website back to the victim. This means that data sent to and from the victim's browser is intercepted. It also means that the victim is presented with the actual target site, not an HTML template or cloned version of the target page.

Figure 1. Evilginx2 main menu

The tool is designed to be simple to deploy and can be done in only a few minutes. The threat actor supplies a domain and IP address they control to be used for the attack. From there, they select a target brand from templates to generate a “lure”, which provides the threat actor with a unique URL they can then send to their target, as well as a valid TLS certificate via LetsEncrypt.

Figure 2. A Protonmail lure being generated for their target.

If a victim accesses the attacker’s unique URL, Evilginx presents a proxied version of the desired website. This allows the attacker to log sensitive information such as credentials and session cookies.

Figure 3-1 Figure 3. Protonmail phishing pages presented by Evilginx2

Figure 4. Victim information logged to the console

Once a victim has entered their credentials and MFA token, the session cookies can be retrieved by the threat actor and used to gain access to the victims account without needing to perform any additional verification.

Phishing pages for use by Evilginx2 are dictated by the presence of configuration files called “phishlets”. Phishlets specify configuration items such as the target site to be proxied and what forms and cookies should be logged. It has seen a healthy adoption from users as evidenced by the many contributors and available repositories which contain additional “phishlets”, with dozens available on Github and more for sale on other platforms.

It is worth noting that despite the author's instructions that this tool is for use by professional penetration testers, users routinely post on the issues tab request for phishlets in exchange for compensation. ZeroFOX Alpha Team assesses that it is probable these messages are threat actors and spammers who are looking for phishlets to carry out attacks using Evilginx2.

Figure 5-1 Figure 5-2 Figure 5. Threat actors requesting assistance or discussing use of the tool.

Evilginx2 has begun to adopt additional features which are commonly found in paid-for phishing kits to evade detection by conventional anti-phishing techniques such as web crawlers or scanners. This, along with the capability to quickly adapt and create phishlets to suit the needs of the threat actor Alpha Team believe it is probable that Evilginx2 will see increasing popularity for malicious use.