Modlishka VS evilginx2

I remember some big service many years ago (maybe yahoo?) had a “memorable image” or something that was associated with your username as some kind of anti phish metric. Of course nowadays that would be trivial to bypass with something like Modliskha or a different reverse proxy passing through the website content.

https://github.com/drk1wi/Modlishka

2FA can be "bypassed" by using some phishing and setup like https://github.com/drk1wi/Modlishka

Apps would not help in this case. OTP, Push, SMS, Phone calls are all possible to be compromised using this attack (via reverse proxy for example).

The MFA implemented in Azure is not phishing-proof. This can be phished using a reverse proxy, and the push notification method is often becoming a bad habit for users to always approve ("this was from Microsoft, so it looked legit"). The only phishing proof method is using FIDO2 authenticators, but that is Passwordless, not MFA

Step 1. The user becomes a victim of an advanced phishing attack with MFA phishing included, so the attacker's phishing script logs in using both password and MFA code. Step 2. The attacker uses the session cookie to impersonate the victim. Step 3 is the same as with Option A.

* https://github.com/drk1wi/Modlishka

GitHub - drk1wi/Modlishka: Modlishka. Reverse Proxy.

See things like https://github.com/drk1wi/Modlishka

No, if you break into a site using passkeys, it gives you literally zero information that can be used to authenticate as any of the users. Think about the prevalence of data breaches in the past decade, and the sharp rise in the effectiveness of password stuffing, and think about why this change might be a good idea.

Also even with traditional 2FA, TOTP can be phished. See https://github.com/kgretzky/evilginx2

WebAuthn almost entirely eliminates phishing risk, and Passkeys are a really nice, clean UX for using WebAuthn.

So I downloaded this onto my computer https://github.com/kgretzky/evilginx2 and that took while since I’m new to GitHub and I barely know my way around computers. That went fine, i noticed there was another repository that was pretty much an add on to that same software I downloaded earlier “evilginx2” by another creator, this is the link https://github.com/simplerhacking/Evilginx3-Phishlets

Did your friend clicked on a phising link, if yes a aitm coud be one of the possibilities: https://github.com/kgretzky/evilginx2

We had a user compromised simiarly the other day, with what I believe to be https://github.com/kgretzky/evilginx2 now. It stole his session cookie and was able to auth. Fortunately, we have Office 365 Defender and he was flagged immediately on the risky user sign-ins and we were able to block and investigate.

Evilginx kan bypass MFA and hijack your session https://github.com/kgretzky/evilginx2 Only thing that migitates this is fido keys

You can try this for web app traffic MIMD: https://github.com/kgretzky/evilginx2