Threat intelligence / Tool

evilginx2

[evilginx2](https://attack.mitre.org/software/S9003) is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. [evilginx2](https://attack.mitre.org/software/S9003) can be used as a reverse proxy between victims and legitimate web services to intercept and capture credentials, authentication tokens, and session cookies.(Citation: Evilginx 2 July 2018)(Citation: Breakdev Evilginx 2.1 SEP 2018)(Citation: Sophos Evilginx MAR 2025)

Tool

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[evilginx2](https://attack.mitre.org/software/S9003) is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. [evilginx2](https://attack.mitre.org/software/S9003) can be used as a reverse proxy between victims and legitimate web services to intercept and capture credentials, authentication tokens, and session cookies.(Citation: Evilginx 2 July 2018)(Citation: Breakdev Evilginx 2.1 SEP 2018)(Citation: Sophos Evilginx MAR 2025)

Labels

tool

14 recorded

Relationships

uses

to Adversary-in-the-Middle

Technique

uses

to Browser Session Hijacking

Technique

uses

to Data Encoding

Technique

uses

to Data Obfuscation

Technique

uses

to Execution Guardrails

Technique

uses

to External Proxy

Technique

uses

to Install Root Certificate

Technique

uses

Technique

uses

to Multi-Factor Authentication Interception

Technique

uses

to Spearphishing Link

Technique

uses

to Steal Web Session Cookie

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Web Protocols

Technique

4 external

References

mitre-attack

S9003

Sophos Evilginx MAR 2025

https://www.sophos.com/en-us/blog/stealing-user-credentials-with-evilginx

Breakdev Evilginx 2.1 SEP 2018

https://breakdev.org/evilginx-2-1-the-first-post-release-update/

Evilginx 2 July 2018

https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/