New Phishing Kits Use Open-Source Tools to Bypass MFA

Researchers at Lexfo have identified three sophisticated phishing kits built from Evilginx forks that proxy live Microsoft 365 authentication sessions to capture session cookies and OAuth tokens, bypassing multi-factor authentication. The kits incorporate AI-generated personalized lures, multiple delivery formats, and anti-detection features (sender rotation, attachment encryption, HTML-to-image conversion), and are publicly available via GitHub and commercial channels, meaning defenders should assume threat actors of any skill can perform MFA-bypassing AiTM campaigns.