Evilginx: Phishing That Bypasses MFA

For years the standard advice was simple: turn on multi-factor authentication and phishing largely stops working. Evilginx is the tool that broke that assurance. It is an adversary-in-the-middle phishing framework that steals not passwords but session tokens , which lets an attacker walk straight past MFA even when the victim enters a correct code. If your entire anti-phishing strategy rests on “we have MFA,” this is the tool that explains why that is no longer enough.

It belongs in any current social engineering penetration test, because testing against yesterday’s phishing while attackers use this one gives a false sense of safety.

Why ordinary MFA stopped being enough

Classic credential phishing captures a username and password on a fake login page. With MFA enabled, that stolen password is not enough , the attacker still needs the second factor, and by the time they try to use it, the one-time code has expired. MFA worked because it broke the reuse of stolen static credentials.

Evilginx defeats this by not playing that game. Instead of capturing credentials to reuse later, it sits between the victim and the real site in real time, and steals the thing that proves you already passed MFA: the session token.

How adversary-in-the-middle works

The technique is a transparent reverse proxy , and understanding it is the whole point:

1. The victim receives a phishing link and clicks it, landing on the attacker’s server.
2. That server does not host a fake page. It proxies the real website , the victim sees the genuine login page, because it is the genuine page, relayed through the attacker.
3. The victim enters their username, password, and , crucially , their MFA code. Everything is passed through to the real site, which accepts it. Authentication genuinely succeeds.
4. The real site returns a session token (a cookie) proving the victim is now logged in. Because the attacker sits in the middle, they capture that token.
5. The attacker imports the token into their own browser and is now logged in as the victim , no password re-entry, no MFA prompt. The session is already authenticated.

The victim experiences a completely normal login on the real site and suspects nothing. The attacker walks away with an authenticated session, MFA and all.

What this means for your defences

Evilginx does not break MFA cryptographically , it sidesteps it by stealing the result. That has direct consequences for how you should think about phishing defence:

• “We have MFA” is no longer a sufficient answer. Standard MFA , SMS codes, authenticator-app codes, push approvals , is all vulnerable to this, because all of it produces a session token the proxy can steal.
• Awareness training built around old signals falls short. There is no misspelled domain to catch if the page is the real one proxied, and there is no “the site looked wrong” because it did not. Training has to evolve past “look for the fake page.”
• Session tokens are now a high-value target, which changes how you think about session lifetime, binding, and monitoring.

What actually stops it: phishing-resistant MFA

The good news is that a specific class of MFA defeats this attack by design:

FIDO2 security keys and passkeys. These use public-key cryptography bound to the real site’s domain. The authentication is cryptographically tied to the legitimate origin, so when the victim is on the attacker’s proxy domain, the check simply fails , there is no code or token for the proxy to relay or steal. This is why “phishing-resistant MFA” is not marketing language; against adversary-in-the-middle it is the difference between working and not.

Layered alongside it:

• Conditional access and device trust , requiring a managed, compliant device makes a stolen token far less useful from an attacker’s machine.
• Token binding and shorter session lifetimes , limiting how long and from where a stolen token is valid.
• Impossible-travel and anomaly detection , flagging a session suddenly used from a new location or device.
• Modern awareness training , teaching that even a perfect-looking login reached through an unexpected link is dangerous, and that hardware-key prompts failing is a signal, not a glitch.

How it is used in testing

In an authorised social engineering penetration test or red team assessment, Evilginx-style adversary-in-the-middle phishing tests the defences that actually matter today: does your MFA resist token theft, or merely stop password reuse? A test that captures a session and reaches your systems despite MFA is one of the most valuable findings you can get , because it corrects the specific false confidence (“we have MFA, we’re fine”) that this attack exists to exploit. It pairs naturally with spear phishing for the lure and pretext, and the finding usually drives a move to phishing-resistant MFA on the accounts that matter.

The short version

Evilginx is adversary-in-the-middle phishing: it proxies the real login page, lets the victim authenticate for real , password, MFA code and all , and steals the resulting session token to log in as them, bypassing MFA entirely. It means “we have MFA” is no longer a complete defence, and that awareness training built on spotting fake pages misses this attack. What stops it is phishing-resistant MFA , FIDO2 keys and passkeys , backed by device trust and session monitoring. Testing against this technique is the only way to know whether your MFA actually resists a modern phishing attack or just an old one.

Confident in your MFA? A social engineering test that includes adversary-in-the-middle phishing is the way to find out whether it resists token theft , before an attacker checks for you. Scope one here.