Introduction

In the cybersecurity landscape, the cat-and-mouse game between attackers and defenders is accelerating. For years, we’ve relied on Multi-Factor Authentication (MFA) as the silver bullet against credential harvesting. However, the reality is that the barrier to entry for bypassing MFA has never been lower.

At VSAT Security, we believe that understanding the offensive playbook is the first step to building resilient defenses. To show just how accessible these attacks have become, we recently ran a controlled simulation using our own infrastructure. The results are a wake-up call for organizations relying on legacy security postures.

The Ease of Evilginx: A Phishing Simulation

To demonstrate the current threat landscape, we set up a scenario using Evilginx, a popular Adversary-in-the-Middle (AiTM) phishing framework.

wvilginx

Evilginx2 Kali Page

Before diving into the simulation, it is important to understand how an Adversary-in-the-Middle (AiTM) framework like Evilginx is set up. The framework relies on two foundational concepts: Phishlets and Lures.

Phishlets: Think of a phishlet as the blueprint for the attack. It is a configuration file that tells Evilginx exactly how to proxy a specific target website (like Microsoft 365). It dictates how to modify web traffic on the fly, inject scripts, and specifically which session cookies and authentication tokens need to be intercepted.
Lures: If the phishlet is the blueprint, the lure is the bait. A lure is the unique, generated URL—tied to a specific phishlet—that is actually sent to the victim in a phishing email. When clicked, it routes the victim through the attacker’s infrastructure.

While the setup might sound simple, maintaining it is incredibly difficult. Finding or creating a working phishlet and lure for a major platform like Microsoft is challenging because Microsoft frequently updates its login flows and anti-phishing defenses specifically to break these proxies and negate the lures. A setup that works perfectly on Monday might be entirely obsolete by Tuesday.

Because of this constant cat-and-mouse game, the most reliable way for red teamers and security professionals to get working, up-to-date phishlets is to buy the professional tier of the framework, Evilginx Pro or create your own custom phishlet in a yaml file format. The Pro version provides access to a curated community database of officially maintained phishlets, allowing operators to bypass the headache of constantly reverse-engineering Microsoft’s latest security updates.

If you are not a fan of buying into the Pro version to access phishlets, you can look to github for community created phishlet templates for free like this one. Please note that these phishlets typically do not work out the box and require adjustments.

6ibygAAAABJRU5ErkJggg==

Github Repo of Phishlets – https://github.com/simplerhacking/Evilginx3-Phishlets

Setting up a highly convincing phishing lure using Evilginx is shockingly straightforward. The framework acts as a reverse proxy, sitting seamlessly between the victim and the legitimate service (like Microsoft 365 or Google Workspace). When we sent our simulated phishing email and clicked the link, we weren’t taken to a static, fake HTML page—we were interacting with the actual login portal, routed entirely through our attacker-controlled server. Below is what a victim of a phishing email would see.

VSAT Security Evilginx Simulation – Phishing Lure and Fake Domain

The danger of Evilginx lies in what it captures in transit. In our simulation, the framework easily recorded:

Usernames and Passwords: The traditional keys to the kingdom.
User Agents: Attackers log the victim’s browser and operating system details, allowing them to spoof the environment later and make their malicious logins look entirely legitimate to basic security filters.
Session Cookie Tokens: This is the critical blow. Once the user completes their MFA prompt (via SMS, authenticator app, etc.), the legitimate service issues a session cookie. Evilginx intercepts this token.

By injecting this stolen cookie into their own browser, the attacker effectively bypasses MFA entirely, gaining persistent, authenticated access to the account.

wvilginx

Evilginx Simulation – Captured Credentials and Session Token

The Defender’s Perspective: Hunting the Breach

While tools like Evilginx make attacks easy, they leave a distinct trail. For defenders, identifying the initial breach is just the beginning; scoping the incident is where the real work happens.

If you identify a compromised account, the most critical forensic artifact is the SessionID. By pivoting on the session ID associated with the malicious login, defenders can query their logs to uncover the full scope of the threat actor’s activity during that specific session, filtering out the user’s legitimate background noise.

When hunting for AiTM activity, your Security Operations Center (SOC) should be on high alert for the following indicators:

Anomalous Sign-ins: Logins originating from known VPN nodes, TOR exit nodes, or generally bad/impossible IPs immediately following an MFA prompt.
Illicit Consent Grants: Attackers often use their access to grant permissions to malicious OAuth applications, ensuring they maintain persistence even if the user’s password is changed or the session is killed.
Suspicious Inbox Rules: A classic post-compromise tactic is hiding the evidence. Look for newly created email forwarding rules or rules that move emails to the RSS/Deleted folders. Attackers often name these rules obscurely using simple punctuation, such as . , .. , or ..... to avoid visual detection by the end-user.

The Next Frontier: AI and the Starkiller Phishing Suite

If Evilginx represents the current standard of AiTM attacks, the horizon is looking even darker. We are now witnessing the rapid rise of AI-enhanced and highly automated phishing frameworks, most notably the Starkiller Phishing Suite.

Starkiller takes the reverse-proxy concept of Evilginx and turns it into a commercial-grade, Software-as-a-Service (SaaS) platform for cybercriminals. Instead of requiring attackers to manually configure proxy servers and manage certificates, Starkiller automates the entire process.

It launches a headless Chrome browser inside a Docker container to load a brand’s real website and proxy it to the victim live. Because the page is rendered dynamically in real-time, there are no static template files for security vendors to fingerprint or blocklist. Combined with AI-driven URL masking, automated evasion techniques, and a polished dashboard for real-time session monitoring, frameworks like Starkiller are actively lowering the skill barrier for sophisticated MFA-bypass attacks.

Defending Against the AI Threat

The transition from static credential harvesting to dynamic, session-stealing AI frameworks means that “good enough” security is no longer enough. To combat platforms like Starkiller, organizations must modernize both their technical controls and their human firewall:

Fight AI with AI in Security Training: Traditional, static phishing simulations are no longer sufficient to train employees against hyper-realistic, AI-generated lures. Organizations should leverage advanced awareness platforms like KnowBe4. By utilizing KnowBe4’s Artificial Intelligence Defense Agents (AIDA) and AI-driven phishing campaigns, you can continuously test your workforce with sophisticated, personalized lures that adapt to individual learning curves and mimic the exact tactics used by modern threat actors.
Implement Phishing-Resistant MFA: Move away from SMS-based or simple push-notification MFA. Adopt FIDO2-compliant security keys (like YubiKeys) or passkeys, which cryptographically bind the authentication token to the actual domain, rendering AiTM proxy lures useless.
Identity-Aware Session Analysis: Deploy conditional access policies that evaluate the risk of a session continuously, not just at the initial login. Monitor for anomalies in behavioral biometrics, impossible travel, and sudden shifts in IP reputation.

Securing the Future with VSAT Security

The transition from static credential harvesting to dynamic, session-stealing AI frameworks means that “good enough” security is no longer enough. Organizations must pivot toward identity-aware session analysis, phishing-resistant MFA (like FIDO2 passkeys), and proactive threat hunting.