Evilginx

I am the evil bot capturing your MFA tokens.

Offensive security reverse-proxy phishing framework capable of bypassing MFA protections, created by @mrgretzky

[Evilginx @evilginx]

I approve this message! 🪝🐟

[John Hammond @_JohnHammond]

Session hijacking a Microsoft 365 account! Stealing their credentials and bypassing MFA prompt with Evilginx: a reverse-proxy phishing framework! We stage a phishing domain and email pretense, and gain full access to the victim account! https://t.co/E29wB0yNXt

[Evilginx @evilginx]

@jsark983 🍪👀

[Rey Bango 🇺🇦🌻 @reybango]

Black Friday and Cyber Monday deals are out! I review some of them and link to a community GitHub page for you all to get discounts on courses, tools and services!

Deals from @_RastaMouse, @_JohnHammond, @offsectraining, @evilginx, @Antisy_Training and a whole lot more.

https://t.co/gPRSiB4FoP

[☠ Dani Martinez ☠ @dan1t0]

🚨 "Working With Evilginx On-Premises"

For projects where OPSEC is critical: keep sensitive data on your server, use cloud only for redirectors.

Architecture: Cloudflare → Caddy → Evilginx (on-prem via Tailnet)

https://t.co/ZNd8CuHKwI @evilginx @mrgretzky #Phishing #OPSEC

[Evilginx @evilginx]

The official MFA phishing anthem! 🍪💗🎵

[UwU Underground @uwu_underground]

🎵🎧
.lıllılı.ıllı.ılılıılıı.lllııılı.
UwU Underground
Now Playing: [I Stole Your MFA]
0:44 ———♡———1:52
◁◁ ▐ ▌ ▷▷
Get Psyopped By New Music, Mammals

[Evilginx @evilginx]

@uwu_underground 💗🍪💗

[Kuba Gretzky @mrgretzky]

🚨 The Black Friday sale is coming!

The sale drops at midnight today! (UTC+1)

It will be the biggest sale yet! 🤩

[Evilginx @evilginx]

Black Friday is on 29th November this year. Just sayin'... 🤫

[Tarek @Cyber_Tarek]

Black hat Asia training is completed. Two days of sharing with our students how APTs compromise AD and Entra ID. And I couldn't help but give a quick shout-out to @evilginx

Next stop is @x33fcon & I'm looking forward to it!

[Evilginx @evilginx]

@DeanOfCyber @x33fcon I'm mindblown! 🤯 Thank you, Tarek! Will have a chance to give you a high five in person at @x33fcon 😀👍

[Kuba Gretzky @mrgretzky]

Merry Christmas everyone! ❄️☃️🎄

Wish you all the best and thank you for a great year! ✨️

[Kuba Gretzky @mrgretzky]

🚨 BLACK FRIDAY Evilginx Mastery -40% SALE 🚨

👑 40% discount (biggest yet!)
⏰ Only 24 hours

Code: BLACKFRIDAY40SALE
Link: https://t.co/XxQ1SO8N3t

Hurry! It's active only until tomorrow!

[Kuba Gretzky @mrgretzky]

🚨 Evilginx Mastery Black Friday SALE is coming... tomorrow! 🔥

It will be the BIGGEST sale so far! 🤩

⏰ Sale will last only 24 hours.

[Shaheryar Popalzai @spopalzai]

The @evilginx Mastery course is way too much fun 👀

[Evilginx @evilginx]

@SwiftOnSecurity @mrgretzky 🔥🔥🔥

[SwiftOnSecurity @SwiftOnSecurity]

The purpose of SMS/Push/# matching MFA was to put you past most victims and thus most toolsets. There was a point you were basically immune with legacy protocols turned off in Exchange. Now that stronger methods are normalized, attackers are targeting their weaknesses. Not done.

[Evilginx @evilginx]

@mwaski88 Round 2 is closed now. Round 3 will open after launch, but you can also reach out privately.

[John Hammond @_JohnHammond]

Session hijacking a Microsoft 365 account! Stealing their credentials and bypassing MFA prompt with Evilginx: a reverse-proxy phishing framework! We stage a phishing domain and email pretense, and gain full access to the victim account! https://t.co/E29wB0yNXt

[Kuba Gretzky @mrgretzky]

🚨 The big reveal of Evilginx Pro is finally OUT! 🚨

📔From this blog post you will learn what makes the Pro version different from the community one.

🎟️I explain how Evilpuppet secret token extraction works and showcase the core features.

Enjoy! 🪝🐟
https://t.co/kQyxOOiODI

[Kuba Gretzky @mrgretzky]

🎬Phishing LinkedIn and bypassing MFA demo created for the upcoming Evilginx Pro post 🔥

💡Evilginx uses a background browser to capture the secret token from legitimate website and inject it back into the reverse proxy phishing session.

P.S. Enjoy that Cyberpunk tune I made 🎵