Last Updated: 2026-09-08T17:22:21Z
What’s Happening
CloudSEK has a new report on a sizeable phishing campaign powered by a custom implementation of Evilginx2.
Evilginx is an offensive reverse proxy tool designed to present legitimate authentication portals and capture usernames, passwords, and returned session tokens from the authenticating server. It does this by simply sitting in between the user and the legitimate site.
This attack goes beyond normal Evilginx attacks with a couple tricks. First, the traffic is routed through geo-sensitive proxies. If the user is geolocated in India (like CloudSEK), the traffic will route through an Indian proxy before reaching the authenticating service. This makes impossible-travel detections much more difficult, especially combined with residential proxy networks to reduce the signal on the proxy source.
Second, custom JavaScript targeting M365 downgrades security, forcing security key users to resort to traditional TOTP second-factors, which are of course bypassed by token interception.
Why bother with the downgrade? Security keys and passkeys would not work, given the Origin domain (the reverse proxy) doesn’t match the expected source. WebAuthn prevents that abuse, but not this kind of downgrade.
Actions
There are Indicators/Observables on the post, and we’re adding these to MISP as well. While this campaign seems to target mostly India, the techniques should be considered universally applicable.
One of the best defenses against proxy attacks is a good password manager. By not suggesting fill on strange domains, password managers (combined with user training) provide a strong signal that a proxy site is suspicious.
Notes
Passkeys are good. And if passkeys become the norm in an org (difficult), authenticating with a downgraded second factor also becomes a strong signal.
