--- title: "Evilginx: bringing phishing to a whole new level" description: "In this article, I want to tell you more about a very dangerous type of phishing: Evilginx. It's very efficient because very difficult to detect." image: https://blog.easi.net/hubfs/Images/Security/Header%20template.png --- [![Home](https://blog.easi.net/hubfs/easi-logo.svg)](https://easi.net) Hit enter to search - [All](https://blog.easi.net/en) - [Adfinity](https://blog.easi.net/en/tag/adfinity) - [Cloud](https://blog.easi.net/en/tag/cloud) - [Easi](https://blog.easi.net/en/tag/easi) - [Microsoft](https://blog.easi.net/en/tag/microsoft) - [Rooftop](https://blog.easi.net/en/tag/rooftop) - [Security](https://blog.easi.net/en/tag/security) - [SmartSales](https://blog.easi.net/en/tag/smartsales) - [Spoom](https://blog.easi.net/en/tag/spoom) [Go back to the blog](https://blog.easi.net/en?hsLang=en) # [Evilginx: bringing phishing to a whole new level](https://blog.easi.net/en/solutions/security/evilginx-bringing-phishing-to-a-whole-new-level) [![Author Avatar](https://blog.easi.net/hubfs/Images/Security/Screenshot%202021-12-16%20at%2009.17.06.png) Robin Bruynseels Cyber Security Engineer](https://blog.easi.net/en/author/robin-bruynseels) Phishing attacks remain very popular with cybercriminals, especially since the beginning of the pandemic. Since then, the number of attacks targeting companies has strongly risen. Hackers are very resourceful and will not back down from anything to try and steal your private or companies’ data and ultimately launch a [ransomware](https://easi.net/en/solutions/security/ransomware) attack.   The problem is that not many people know how easy it is to fall for it. Even to the trained eyes. There exists a pernicious type of phishing attack that uses a simple tool called Evilginx. The level of simplicity and damage it can do to private individuals and companies really gave me the chills. With this article, I want to raise awareness and give you some pointers to protect yourself. ## What is Evilginx? Put simply, Evilginx is a **man-in-the-middle framework** that allows a hacker to steal credentials and authentication tokens, ultimately allowing them to **bypass any form of 2 factor-authentication (2FA).** #### What’s the difference with “basic” phishing attacks? There is **one major difference** between attacks using Evilginx and the ones that do not. With basic phishing attacks, hackers try to recreate, as faithfully as possible, lookalike HTML templates of sign-in pages (from Outlook, LinkedIn, etc). They will then attempt to lure the victims into entering their credentials, which are then logged and stolen by the hacker. Evilginx takes it one steps further. Instead of showing templates of lookalike pages, it **acts as a relay between the real website and the phished user**. After clicking on a malicious link, phished victims are sent to the real website, unaware that Evilginx is capturing the data being transmitted between the two parties. ![Picture 1](https://blog.easi.net/hs-fs/hubfs/Images/Security/Picture%201.png?width=648&name=Picture%201.png) #### Not even 2-factor authentication can save you Today, 2FA remains one of the best ways to prevent basic phishing attacks. If a hacker manages to retrieve your login and password, **he won’t be able to access your account** because 2FA acts as a second line of defense. This is a whole different ball game with Evilginx. Even if a phished user has 2FA enabled, the attacker **will still be able to remotely take over the account**. How? Like I said before, Evilginx acts as a man-in-the-middle between the **actual target website** and the victim to intercept credentials and authentication tokens. When the victim enters its credentials and is asked to provide a 2FA challenge answer, he will receive a code because he is **talking to the real website**, with Evilginx sitting in the middle. ![Picture 1-1](https://blog.easi.net/hs-fs/hubfs/Images/Security/Picture%201-1.png?width=648&name=Picture%201-1.png) I don’t want to get too technical about what happens in the background. What you need to know is that after a 2FA challenge is completed and the website confirms its validity, a **session token is generated in form of a cookie**. This cookie is intercepted by Evilginx and saved, allowing the attacker to bypass 2FA protection. At this point, the hacker now holds all the key to successfully connect to the victim’s account, fully bypassing 2FA protection. If you want to see Evilginx in action, I have created a short demonstration video: ## 3 ways to protect yourself from Evilginx attacks Like any phishing attempts, there are simple ways to protect yourself from it. #### **1.Double check the website domain** One of the (only) flaw of Evilginx, is that hackers need to **register their own domain**. Which will be (slightly) different than the actual domain of the website. For example, if a hacker is targeting Outlook, they will probably register a domain name such as outloook.com or outl00k.com, making it difficult for potential victims to spot a difference. To make sure you are not falling for an Evilginx attack, **always check the legitimacy of the website domain in the address bar.** **![Picture 1-1](https://blog.easi.net/hs-fs/hubfs/Picture%201-1.png?width=646&name=Picture%201-1.png)** #### **2.Invest in security awareness** Evilginx represents a real danger for companies because it only takes one employee to get phished and allow attackers to steal a vast amount of (confidential) data. That is why **end users are often considered to be the weakest links** of a company’s security posture. [Providing employees with proper trainings and educate them](https://easi.net/en/solutions/security/end-user-awareness) to raise awareness, is the best way to prevent any security breach in a company. #### **3. Use Universal 2nd factor Authentication** Universal 2nd factor Authentication is a **physical hardware key** (a bit like a USB stick) that talks directly with the website. If the domain written in the address bar of the browser does not match the domain expected used for the connection, the communication will be interrupted. Universal 2nd factor authentication **guarantees you that you will never get phished**, even with Evilginx. [![NIS2 whitepaper](https://no-cache.hubspot.com/cta/default/473564/8e2ad46d-2112-47f9-98b1-49e70e3a83a8.png)](https://cta-redirect.hubspot.com/cta/redirect/473564/8e2ad46d-2112-47f9-98b1-49e70e3a83a8) [Easi](https://blog.easi.net/en/topic/easi?hsLang=en) [Security](https://blog.easi.net/en/topic/security?hsLang=en) [Phishing](https://blog.easi.net/en/topic/phishing?hsLang=en) ## Current job openings We are constantly looking for new colleagues! If you share our values and you're looking for a challenging job in Belgium's Best Workplace, visit our website. [Apply now](https://easi.net/en/jobs) ### Get our top stories in your inbox every month ## Follow us [![Share on Facebook](https://static.hubspot.com/final/img/common/icons/social/facebook-24x24.png)](http://www.facebook.com/easi.net) [![Share on LinkedIn](https://static.hubspot.com/final/img/common/icons/social/linkedin-24x24.png)](https://www.linkedin.com/company/easi) [![Share on Twitter](https://static.hubspot.com/final/img/common/icons/social/twitter-24x24.png)](https://twitter.com/easi_net) ## Recent posts ![Microsoft 365 Copilot Cowork: From AI Assistant to AI Coworker](https://blog.easi.net/hubfs/Copilot%20Cowork%20is%20now%20available%20-EN%20%286%29-1.png) ### [Microsoft 365 Copilot Cowork: From AI Assistant to AI Coworker](https://blog.easi.net/en/solutions/microsoft/copilot-cowork-is-now-available?hsLang=en) 01/03/2022 ![Microsoft 365 Archive goes file-level: how to cut SharePoint storage costs from July 2026](https://blog.easi.net/hubfs/Copilot%20Cowork%20is%20now%20available%20-EN%20%283%29.png) ### [Microsoft 365 Archive goes file-level: how to cut SharePoint storage costs from July 2026](https://blog.easi.net/en/solutions/microsoft/m365-archive-file-level?hsLang=en) 01/03/2022 ![GRC in Belgium: Why PROTECT Is Where Insight Becomes Action](https://blog.easi.net/hubfs/GRC%20in%20Belgi%C3%AB%20-%20Protect%20-%20EN%20%281%29.png) ### [GRC in Belgium: Why PROTECT Is Where Insight Becomes Action](https://blog.easi.net/en/solutions/security/grc-in-belgium-why-protect-is-where-insight-becomes-action?hsLang=en) 01/03/2022 ## Share this article [![Share on Facebook](https://static.hubspot.com/final/img/common/icons/social/facebook-24x24.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.easi.net%2Fen%2Fsolutions%2Fsecurity%2Fevilginx-bringing-phishing-to-a-whole-new-level%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on LinkedIn](https://static.hubspot.com/final/img/common/icons/social/linkedin-24x24.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.easi.net%2Fen%2Fsolutions%2Fsecurity%2Fevilginx-bringing-phishing-to-a-whole-new-level%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on Twitter](https://static.hubspot.com/final/img/common/icons/social/twitter-24x24.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.easi.net%2Fen%2Fsolutions%2Fsecurity%2Fevilginx-bringing-phishing-to-a-whole-new-level%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.easi.net%2Fen%2Fsolutions%2Fsecurity%2Fevilginx-bringing-phishing-to-a-whole-new-level%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Evilginx%3A%20bringing%20phishing%20to%20a%20whole%20new%20level) ### Never miss our stories ## Related articles [See all blog articles](https://blog.easi.net/en/tag/easi) ![Easi & Anidris: A shared ambition to become your 360° IT partner](https://blog.easi.net/hubfs/Design%20sans%20titre%20%2813%29.png) ### [Easi & Anidris: A shared ambition to become your 360° IT partner](https://blog.easi.net/en/easi-anidris-a-shared-ambition-to-become-your-360-it-partner?hsLang=en) The merger between Easi & Anidris marks a new milestone in Luxembourg’s IT sector, combining... [Read more](https://blog.easi.net/en/easi-anidris-a-shared-ambition-to-become-your-360-it-partner?hsLang=en) ![AI in Belgian SMEs: from experimentation to real impact](https://blog.easi.net/hubfs/AI%20in%20Belgian%20SMEs%20-%20EN-1.png) ### [AI in Belgian SMEs: from experimentation to real impact](https://blog.easi.net/en/ai-in-belgian-smes-from-experimentation-to-real-impact?hsLang=en) AI is evolving at an unprecedented pace, and the pressure on organisations to keep up is... [Read more](https://blog.easi.net/en/ai-in-belgian-smes-from-experimentation-to-real-impact?hsLang=en) ![The Most Common Cyber Incidents Today](https://blog.easi.net/hubfs/The%20Most%20Common%20Cyber%20Indicents%20Todays%20-%20EN.png) ### [The Most Common Cyber Incidents Today](https://blog.easi.net/en/the-most-common-cyber-incidents?hsLang=en) Cyber-attacks are no longer exceptional crisis situations. Today, they are part of the daily... [Read more](https://blog.easi.net/en/the-most-common-cyber-incidents?hsLang=en) - [Solutions](https://www.easi.net) - [AAA Financials](https://www.easi.net/en/solutions/aaa-financials) - [Adfinity](https://adfinity.easi.net) - [Cloud2be](https://www.easi.net/en/solutions/managed-cloud) - [Rooftop](https://www.easi.net/en/solutions/rooftop) - [Security](https://www.easi.net/en/solutions/security) - [SmartSales](https://www.easi.net/en/solutions/smartsales) - [SmartDrive](https://smartdrive.easi.net) - [SmartShare](https://smartshare.easi.net) - [Synchro Production](https://www.easi.net/en/solutions/synchro-production) - [Services](https://www.easi.net/en/services) - [Mobile Development](https://www.easi.net/en/services/mobile-development) - [Software development](https://www.easi.net/en/services/application-development) - [Managed Services](https://www.easi.net/en/services/managed-services) - [On Premise infrastructure](https://www.easi.net/en/services/it-infrastructure-projects) - [Cosourcing](https://www.easi.net/en/services/co-sourcing) - [End user support](https://www.easi.net/en/services/end-user-support) - [Company](https://www.easi.net) - [About EASI](https://www.easi.net/en/about-easi) - [Jobs](https://www.easi.net/en/jobs) - [Blog](https://blog.easi.net) - [Press](https://www.easi.net/en/press) - [Customer stories](https://www.easi.net/en/customer-stories-references) - [Trainings](https://www.easi.net/en/trainings) - [Events](https://www.easi.net/en/events) - [Customer support](https://www.easi.net/en/customer-support) - [Legal](https://www.easi.net/en/about/legal/website-privacy-policy) - Useful links - [Microsoft](https://www.easi.net/en/services/microsoft) - [IBM Power Systems](https://www.easi.net/en/services/ibm-power-systems) - [IBM Notes](https://www.easi.net/en/services/ibm-notes) - [EASI Jump](https://www.easi.net/en/easi-jump) - [English](https://blog.easi.net/en/solutions/security/evilginx-bringing-phishing-to-a-whole-new-level) - [Français - Belgique](https://blog.easi.net/fr/solutions/security/evilginx-bringing-phishing-to-a-whole-new-level-0) - [Nederlands - België](https://blog.easi.net/nl/solutions/security/evilginx-bringing-phishing-to-a-whole-new-level) - [Privacy](https://www.easi.net/about/legal/website-privacy-policy) - [info@easi.net](mailto:info@easi.net) - [+32 67 28 10 00](tel:+3216313000) - [Contact](https://www.easi.net/en/contact) - - - - - - ```json { "@context" : "https://schema.org", "@type" : "VideoObject", "contentUrl" : "https://473564.fs1.hubspotusercontent-na1.net/hubfs/473564/Evilginx_Video.mp4", "dateModified" : "2022-04-14T07:53:57.243Z", "description" : "", "duration" : "PT1M37S", "height" : 1080, "name" : "Evilginx_Video", "thumbnailUrl" : "https://api-na1.hubapi.com/filemanager/api/v3/files/thumbnail-redirect/68015692080?portalId=473564&size=medium&t=1649922837390", "uploadDate" : "2022-03-08T13:37:41.603Z", "width" : 1920 } ```