evilginx2 VS Evilginx2-Phishlets

No, if you break into a site using passkeys, it gives you literally zero information that can be used to authenticate as any of the users. Think about the prevalence of data breaches in the past decade, and the sharp rise in the effectiveness of password stuffing, and think about why this change might be a good idea.

Also even with traditional 2FA, TOTP can be phished. See https://github.com/kgretzky/evilginx2

WebAuthn almost entirely eliminates phishing risk, and Passkeys are a really nice, clean UX for using WebAuthn.

So I downloaded this onto my computer https://github.com/kgretzky/evilginx2 and that took while since I’m new to GitHub and I barely know my way around computers. That went fine, i noticed there was another repository that was pretty much an add on to that same software I downloaded earlier “evilginx2” by another creator, this is the link https://github.com/simplerhacking/Evilginx3-Phishlets

Did your friend clicked on a phising link, if yes a aitm coud be one of the possibilities: https://github.com/kgretzky/evilginx2

We had a user compromised simiarly the other day, with what I believe to be https://github.com/kgretzky/evilginx2 now. It stole his session cookie and was able to auth. Fortunately, we have Office 365 Defender and he was flagged immediately on the risky user sign-ins and we were able to block and investigate.

Evilginx kan bypass MFA and hijack your session https://github.com/kgretzky/evilginx2 Only thing that migitates this is fido keys

You can try this for web app traffic MIMD: https://github.com/kgretzky/evilginx2

If this all sounds a bit much sticking to classic MFA should be fine but there are pitfalls you should be aware of. Codes sent via SMS can be slow and SIM-swapping attacks almost seem commonplace. One Time Codes generated by an app can easily be intercepted when being typed into a fake login page thanks to tools like EvilNginx and finally MFA prompts from providers like Duo can be overcome with 2fa fatigue attacks.

Think of Evilginx2 as a proxy which is completely trusted by the browser as it's based on nginx. It sends what it needs to Microsoft then it intercepts what you tell it to intercept based on what you code into the phishlet. If after authentication a session cookie is in the browser then it doesn't matter how it got there it can be reused. This is more of browser MITM than an interception of keys.Phishlet Examples