Hackers Using Evilginx to Steal Session Cookies and Bypass Multi-Factor Authentication Tokens

A sophisticated phishing toolkit known as Evilginx is empowering attackers to execute advanced attacker-in-the-middle (AiTM) campaigns with alarming success.

These attacks are engineered to steal temporary session cookies, allowing threat actors to sidestep the critical security layer provided by multi-factor authentication (MFA).

A concerning surge in this method has been observed, with a notable impact on educational institutions, which are now frequently in the crosshairs.

The threat’s foundation is its capacity to hijack a user’s authenticated session, effectively neutralizing MFA’s protection after the initial login.

Evilginx functions by inserting itself as a transparent proxy between an unsuspecting user and a legitimate website.

After a user clicks on a specially crafted malicious link, they are navigated to a phishing page that flawlessly mirrors the authentic site.

This proxy setup relays the genuine sign-in process, capturing the victim’s username and password in real-time.

Critically, once the user validates their identity with an MFA token, the tool intercepts the session cookie issued by the service to recognize and trust the browser for the ongoing session.

The implications of this cookie theft are significant. By simply replaying the stolen session cookie, an attacker can seamlessly impersonate the authenticated user without ever needing to supply credentials or an MFA code again.

Malwarebytes security researchers identified that this grants the intruder unrestricted access to the compromised account. This allows them to read confidential emails, modify critical security settings, or exfiltrate sensitive personal and financial data.

Since the hijacked session is already verified, the attacker’s malicious activities often fail to trigger further security warnings, letting them operate covertly.

A Deceptive and Evasive Attack Flow

The success of Evilginx attacks is rooted in their profound deception. The attacker-controlled phishing pages are not mere static forgeries; they are active proxies that serve the real website’s live content, often complete with a valid TLS security certificate.

This tactic effectively neutralizes common security guidance, such as checking for the browser’s padlock icon.

To further evade detection, attackers often deploy phishing links with very short lifespans, ensuring they disappear before they can be cataloged by security blocklists.

This forces security tools to rely on behavioral analysis, which is not always sufficient to catch every attack, placing a heavy burden on user awareness to spot the initial phishing lure.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Using Evilginx to Steal Session Cookies and Bypass Multi-Factor Authentication Tokens appeared first on Cyber Security News.