MFA Tokens

Overview A new wave of adversary‑in‑the‑middle (AiTM) phishing attacks is targeting Microsoft users worldwide, and the tool behind it — Evilginx — is far more advanced than traditional phishing kits. Security researchers have confirmed that Evilginx can steal usernames, passwords, multi‑factor authentication (MFA) tokens, and authenticated session cookies simultaneously, effectively bypassing MFA entirely. How Evilginx Works Evilginx acts as a transparent proxy between the victim and the real Microsoft login page. When a user clicks a phishing link, they see a perfect replica of the legitimate login portal because it is actually the real page being mirrored live through the attacker’s server. Step Action Result Phishing Link Clicked Victim visits a lookalike domain controlled by the attacker. Connection redirected through Evilginx proxy. Credentials Entered User inputs username and password on the mirrored Microsoft page. Data captured in real time. MFA Approved Victim approves MFA prompt as usual. MFA token and session cookie intercepted. Session Hijacked Attacker imports the session cookie into their browser. Full account access without password or MFA. Once the authenticated session cookie is captured, the attacker can replay it from any device anywhere in the world, gaining complete access to Microsoft accounts without triggering another MFA challenge. Real‑World Case Study Researchers at NetSPI documented a live engagement where Evilginx was used against a corporate executive team. They registered a lookalike domain and pointed an Evilginx server directly at the client’s Microsoft login flow. The attack was wrapped in a social‑engineering scenario that made the phishing email appear urgent and legitimate. Once executives clicked the link and approved their MFA prompts, Evilginx captured their authenticated session cookies instantly. “Even users who follow best practices and enable multi‑factor authentication are not fully protected from this attack,” NetSPI warned. In one case, an executive forwarded the phishing link to two external contractors, nearly turning a single‑company breach into a multi‑organization incident — a stark reminder of how quickly AiTM attacks can spread. […]