Hackers Leverage Evilginx to Undermine MFA Security Mimicking Legitimate SSO Sites

The report describes active phishing campaigns leveraging the Evilginx reverse-proxy framework to present convincing fake SSO portals, capture session cookies and bypass MFA; stolen session tokens are replayed to access cloud email and collaboration services, enabling account takeover, data theft and long-term stealth access—Infoblox analysts observed campaigns targeting universities and documented the proxy-based cookie interception and header rewriting that enable these attacks.