S9003: evilginx2

evilginx2 is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. evilginx2 can be used as a reverse proxy between victims and legitimate web services to intercept and capture credentials, authentication tokens, and session cookies.[1][2][3]

EnterpriseS9003ToolObject v1.0ModifiedApr 23, 2026, 02:18 UTC (UTC+00:00)

S9003: evilginx2 describes [evilginx2](https://attack.mitre.org/software/S9003) is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. [evilginx2](https://attack.mitre.org/software/S9003) can be used as a reverse proxy between victims and legitimate web services to intercept and capture credentials, authentication tokens, and session cookies.(Citation: Evilginx 2 July 2018)(Citation: Breakdev Evilginx 2.1 SEP 2018)(Citation: Sophos Evilginx MAR 2025)

Executive priority

S9003: evilginx2 is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S9003: evilginx2 by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (IaaS, Identity Provider, Office Suite, SaaS), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Cloud control-plane, SaaS audit, and container platform logs

Detection direction

Validate whether S9003: evilginx2 appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

evilginx2

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques14 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1059.007	JavaScriptSub-technique	evilginx2 can inject JavaScript code into HTML content to customize phishing attacks.CitationBreakdev Evilginx 2.3 JAN 2019
Enterprise	T1497.003	Time Based ChecksSub-technique	evilginx2 has the ability to hide phishing lures for a set time to avoid scanning by sandboxes.CitationBreakdev Evilginx 3.2 AUG 2023
Enterprise	T1480	Execution Guardrails	evilginx2 can reject requests to phishing URLs if the User-Agent of the visitor doesn't match the allowlist REGEX filter for a specific lure.CitationBreakdev Evilginx 2.4 SEP 2020
Enterprise	T1539	Steal Web Session Cookie	evilginx2 can collect information on each session with a victim including the session cookie.[1][3]
Enterprise	T1071.001	Web ProtocolsSub-technique	evilginx2 can proxy HTTPS connections between victims and destination websites.[1]CitationBreakdev Evilginx 2.4 SEP 2020CitationBreakdev Evilginx 3.3 APR 2024
Enterprise	T1557	Adversary-in-the-Middle	evilginx2 has the ability to act as an adversary-in-the-middle (AiTM) relay between a legitimate website and a phished user to capture all transmitted data including usernames, passwords, authentication tokens, and session cookies and tokens.[1]CitationBreakdev Evilginx 3.0 May 2023CitationBreakdev Evilginx 3.2 AUG 2023[3]
Enterprise	T1185	Browser Session Hijacking	evilginx2 can inject custom POST arguments into requests to silently enable "Remember Me" options during authentication to stay logged in across browser sessions.CitationBreakdev Evilginx 2.2 NOV 2018
Enterprise	T1111	Multi-Factor Authentication Interception	evilginx2 can intercept authentication tokens to enable bypass of non-phishing resistant forms of MFA.[1]
Enterprise	T1132	Data Encoding	evilginx2 can randomly generate and Base64 encode parameters in phishing links to defeat static detection.CitationBreakdev Evilginx 2.4 SEP 2020
Enterprise	T1553.004	Install Root CertificateSub-technique	evilginx2 has obtained a valid SSL/TLS certificate from LetsEncrypt to provide responses to Automatic Certificate Management Environment (ACME) challenges.[1]
Enterprise	T1090.002	External ProxySub-technique	evilginx2 can route traffic via SOCKS5 and HTTP(S) proxies between an intended phishing victim's machine and legitimate websites.[1]CitationBreakdev Evilginx 2.4 SEP 2020[3]
Enterprise	T1016	System Network Configuration Discovery	evilginx2 can capture information from each session with a victim including the public IP used to access the server and the user agent.[3]
Enterprise	T1598.003	Spearphishing LinkSub-technique	evilginx2 can generate and display phishing URLs including hidden tracking pixels and can also embed URLs within iframes for browser-in-the-browser phishing.CitationBreakdev Evilginx 2.3 JAN 2019CitationBreakdev Evilginx 3.3 APR 2024[3]
Enterprise	T1001	Data Obfuscation	evilginx2 can modify the Origin and Referrer fields in HTTPS headers it relays between intended victims and legitimate websites to comply with cross-origin resource sharing (CORS) restrictions.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.0
Created: Jan 30, 2026, 20:15 UTC (UTC+00:00)
Modified: Apr 23, 2026, 02:18 UTC (UTC+00:00)
Raw hash: e8f6edebd3671360...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.0	Apr 23, 2026, 02:18 UTC (UTC+00:00)	Current bundle	`e8f6edebd367…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Apr 23, 2026, 02:18 UTC (UTC+00:00)	Older bundle	`e8f6edebd367…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Evilginx 2 July 2018
Gretzky, K.. (2018, July 26). Evilginx 2 - Next Generation of Phishing 2FA Tokens. Retrieved October 14, 2019.
Open source URL
[2]
Breakdev Evilginx 2.1 SEP 2018
Gretzky, K. (2018, September 10). Evilginx 2.1 - The First Post-Release Update. Retrieved January 27, 2026.
Open source URL
[3]
Sophos Evilginx MAR 2025
Everts, M. (2025, March 28). Stealing user credentials with evilginx. Retrieved January 27, 2026.
Open source URL
[4]
mitre-attackS9003
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use