Malware

Evilginx

According to the author, Evilginx is a standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.

Indicators of Compromise 12

Domain picis[.]net Domain romnor[.]ca Filename C:\Program Files (x86)\XEOX\xeox-agent_x64.exe Filename evilginx2.exe GitHub Repo codemado/Evilginx GitHub Repo mail-argenta/red-queen GitHub Repo saroula01/black-queen GitHub User codemado GitHub User mail-argenta GitHub User saroula01 IP 185[.]163[.]204[.]7 Registry User RockyBelling

MITRE ATT&CK TTPs 7

T1021.003
Distributed Component Object Model
Lateral Movement
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1188
T1188
 T1555
Credentials from Password Stores
Credential Access
 T1566
Phishing
Initial Access
 T1566.002
Spearphishing Link
Initial Access

Source Articles

Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365
A misconfigured server exposed three active Evilginx phishing operations targeting Microsoft 365 users, enabling attackers to bypass MFA through proxy-based login interception and abuse of Microsoft's legitimate device code flow. The operations, attributed to threat actors codemado, mail-argenta, and saroula01, leveraged custom forks of open-source Evilginx hosted on public GitHub repositories. One campaign used AI-assisted development, and all three harvested corporate credentials, with sessions maintained via long-lived cookies and token refresh mechanisms. The incident highlights the growing accessibility of phishing-as-a-service and the need for robust Conditional Access policies.
hacker-news ·2w ago