APT / THREAT GROUP

Evilginx

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to the author, Evilginx is a standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.

Threat Analysis

Evilginx is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://github.com/kgretzky/evilginx2

→https://osamaellahi.medium.com/the-art-of-defense-evasion-part-3-bypass-multi-factor-authentication-mfa-26d3a87dea0f

→https://www.ironnet.com/blog/robin-banks-still-might-be-robbing-your-bank-part-2

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

Evilginxelf.evilginx

External Intelligence

Malpedia: elf.evilginx

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Evilginx