MITRE ATT&CKsoftware (tool)

S9003 evilginx2

Published 2026-01-30 Modified 2026-04-23 Official page ↗
Domain
enterprise
Platforms
IaaS, Identity Provider, Office Suite, SaaS
Version
1.0
Created
2026-01-30

Description

evilginx2 is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. evilginx2 can be used as a reverse proxy between victims and legitimate web services to intercept and capture credentials, authentication tokens, and session cookies.

Related

Uses · MITRE ATT&CK (14)

  • T1598.003 Spearphishing Link sub-technique
  • T1059.007 JavaScript sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1090.002 External Proxy sub-technique
  • T1497.003 Time Based Checks sub-technique
  • T1553.004 Install Root Certificate sub-technique
  • T1557 Adversary-in-the-Middle technique
  • T1539 Steal Web Session Cookie technique
  • T1480 Execution Guardrails technique
  • T1185 Browser Session Hijacking technique
  • T1001 Data Obfuscation technique
  • T1016 System Network Configuration Discovery technique
  • T1111 Multi-Factor Authentication Interception technique
  • T1132 Data Encoding technique

References