Evilginx 3: AiTM Phishing and MFA Bypass for Red Teams

Fri, 19 Jun 2026 00:00:00 +0000

Multi-factor authentication doesn’t stop Adversary-in-the-Middle phishing. The technique doesn’t bypass MFA — it lets the victim complete it normally, then steals the session cookie Microsoft issues afterward. The attacker never touches the MFA step. They take what comes out of it.

Evilginx 3 is the open-source red team framework for demonstrating this attack class in authorized engagements. Written in Go by security researcher Kuba Gretzky, it runs a self-contained reverse proxy with its own HTTP and DNS server — no nginx dependency, no external daemons. This article covers the full red team workflow: infrastructure, installation, phishlet structure, session capture, and the detection indicators every blue team should know.

Microsoft MFA Bypass on Ethical Hacking | Pentest e Sicurezza Informatica | Hackita

Evilginx 3: AiTM Phishing and MFA Bypass for Red Teams

Evilginx 3: Complete Guide to AiTM Phishing, MFA Bypass, and Session Cookie Theft #