frameless-bitb

Frameless BITB A new approach to Browser In The Browser BITB without the use of iframes, allowing the bypass of traditional framebusters implemented by login pages like Microsoft. This POC code is built for using this new BITB with Evilginx, and a Microsoft Enterprise phishlet. Before diving deep...

evilginx2

Evilginx 3.0 Evilginx は、ログイン認証情報とセッションクッキーをフィッシングするために使用される中間者攻撃フレームワークであり、これにより2要素認証の保護を回避できます。 このツールは、2017年にリリースされた Evilginx の後継です。以前のバージョンではカスタムバージョンのnginx HTTPサーバーを使用して中間者機能を提供し、ブラウザとフィッシング対象のWebサイトの間でプロキシとして動作していました。...

evilginx2

Evilginx 3.0 Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

evilginx

Evilginx v.1.1.0 このバージョンは廃止されました。最新バージョンを使用してください！ EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginxは、あらゆるウェブサービスの認証情報やセッションCookieをフィッシングするために使用される中間者攻撃フレームワークです。そのコアはNginx HTTPサーバー上で動作し、proxypassとsubfilterを利用してHTTPコンテンツをプロキシし変更しながら、クライアントとサーバー間のトラフィックを傍受します。 仕組みやインストール方法については、私のブログで学べます：...

frameless-bitb

Frameless BITB iframeを使用しない、新しいBrowser In The Browser BITBアプローチ。これにより、Microsoftのようなログインページが実装する従来のフレームバスターを回避できます。 このPOCコードは、この新しいBITBをEvilginxおよびMicrosoft Enterpriseフィッシュレットと共に使用するために構築されています。 詳しく見る前に、まずはBSides 2023での私の講演をご覧になることをお勧めします。このコンセプトを初めて紹介し、「完璧な」フィッシング攻撃を仕掛けるための重要な詳細について説明しました。▶ 動画を見る...

DefinitelyNotPhishing

⚠️ 免责声明 本仓库仅用于教育和测试目的 。 此处包含的所有工具、配置和资源（如钓鱼模板、红队工具或攻击性安全脚本）严格限定于授权环境 中使用，例如实验室、演示或已获得明确许可 的渗透测试场景。 请勿 使用本代码、数据或任何衍生内容在未经同意的情况下执行未授权攻击、钓鱼活动或入侵系统。 对于使用此处任何材料进行的误用、滥用或任何非法活动，我不承担任何责任 。 未经许可使用这些工具针对系统或个人可能违法并应受到法律制裁 。 请负责任且合乎道德地行事。 这是一个红队学习与演示套件——并非用于现实世界恶意用途的工具包 。 Evilginx 预览 Evilginx Phishlets Amazo...

decode-spam-headers

decode-spam-headers.py Whether you are trying to understand why a specific e-mail ended up in SPAM/Junk for your daily Administrative duties or for your Red-Team Phishing simulation purposes, this script is there for you to help! Idea arose while delivering a commercial Phishing Simulation...

Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing switched on. The command that did it: python3 -m http.server 8080, was still sitting in the readable .bashhistory. From that one lapse, French security firm Lexfo...

PT-2026-48522

Name of the Vulnerable Software and Affected Versions Evilginx community edition affected versions not specified Description A path traversal issue exists in the redirector templates of the community edition, which allows for arbitrary file reading. This occurs in lures configured with redirector...

Explainable Machine Learning for Phishing Detection on Heterogeneous Datasets with MCP-Enabled Deployment

With the growth in digital transformation and Internet usage, the Social Engineering techniques such as Phishing have become a major concern for the users and the organizations. Phishing attacks involve deceptive techniques to trick users into revealing confidential information that causes...

Over 70 Domains Used in Months-Long Phishing Spree Against US Universities

Infoblox Threat Intel reports a campaign that used the Evilginx phishing kit to bypass Multi-Factor Authentication MFA and steal credentials from 18 US universities between April and November 2025...

Attackers have a new way to slip past MFA in educational orgs

Researchers are warning about a rise in cases of attackers using Evilginx to steal session cookies among educational institutions—letting them bypass the need for a multi-factor authentication MFA token. Evilginx is an attacker-in-the-middle phishing toolkit that sits between you and the real...

Russian Hackers Breach 20+ NGOs Using Evilginx Phishing via Fake Microsoft Entra Pages

Microsoft has shed light on a previously undocumented cluster of malicious activity originating from a Russia-affiliated threat actor dubbed Void Blizzard aka Laundry Bear that it said is attributed to "worldwide cloud abuse." Active since at least April 2024, the hacking group is linked to...

Cybercriminals Use Go Resty and Node Fetch in 13 Million Password Spraying Attempts

Cybercriminals are increasingly leveraging legitimate HTTP client tools to facilitate account takeover ATO attacks on Microsoft 365 environments. Enterprise security company Proofpoint said it observed campaigns using HTTP clients Axios and Node Fetch to send HTTP requests and receive HTTP...

How AitM Phishing Attacks Bypass MFA and EDR—and How to Fight Back

Attackers are increasingly using new phishing toolkits open-source, commercial, and criminal to execute adversary-in-the-middle AitM attacks. AitM enables attackers to not just harvest credentials but steal live sessions, allowing them to bypass traditional phishing prevention controls such as MF...

PenTales: What It’s Like on the Red Team

At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re sharing some of our favorite tales from the pen test desk and hopefully highlight som...

A week in security (May 7 – May 13)

Last week on Labs, we looked at the case of a fake Android AV, an annoying adware that goes by the name of Kuik, the return of threat actors behind the Shopper Stop tech scam, a new Netflix phishing scam, the recent zero-day vulnerability in Internet Explorer, and the insufficiency of merely...