Loading malware…
EvilProxy is a phishing-as-a-service adversary-in-the-middle phishing kit used to steal credentials and authenticated web sessions from victims, particularly against enterprise identity platforms such as Microsoft 365 and other major online services. Emerging in 2022, it lowered the barrier to conducting reverse-proxy phishing by providing operators with a managed service, graphical administration features, campaign customization, and deployment guidance. Some reporting also refers to the platform as Moloch.
The kit operates by proxying traffic between the victim and a legitimate authentication service in real time, allowing the attacker to capture usernames, passwords, one-time codes, and especially session cookies or tokens. This enables session hijacking and can bypass multi-factor authentication without defeating the underlying authentication mechanism directly. EvilProxy has been repeatedly associated with campaigns that redirect victims from lures or OAuth-based redirect abuse into attacker-controlled login flows, after which the kit relays authentication and harvests the resulting session material.
EvilProxy has been used in enterprise-focused phishing operations, including attacks against Microsoft 365 users, government and public-sector organizations, universities, multinational institutions, and businesses targeted through procurement, document-sharing, and support-themed lures. It has also been linked to campaigns targeting software developers and package ecosystem accounts, raising supply-chain risk. Delivery has been observed through phishing links, compromised email threads, cloud-hosted phishing pages, and other attacker-in-the-middle workflows; hosting on trusted platforms such as Google Sites has also been reported.
Operationally, EvilProxy is characterized as a mature commercialized phishing kit with anti-analysis and victim-filtering features, including bot and environment checks, and it has appeared alongside or in competition with other AiTM kits such as Evilginx, Tycoon 2FA, Sneaky2FA, FlowerStorm, and Kali365. It has been abused by financially motivated actors and has appeared in intrusion chains associated with groups such as Storm-1811 and Black Basta, where it supported credential theft and session takeover as part of broader ransomware or post-compromise activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Storm-1811 also provides the target user with malicious links that redirect the user to an EvilProxy phishing site to input credentials. EvilProxy is an adversary-in-the-middle (AiTM) phishing kit used to capture passwords, hijack a user’s sign-in session, and skip the authentication process.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
One clear trend is the abuse of cloud infrastructure. Phishing incidents on Cloudflare Pages domains nearly tripled from 460 in 2023 to more than 1,370 in 2024... Other widely trusted services, including Azure Blob Storage, Google Firebase, AWS CloudFront, and Amazon S3, have also hosted phishing assets.
Resecurity has acquired videos released by EvilProxy actors demonstrating how it can be used to steal the victim’s session and successfully go through Microsoft 2FA and Google e-mail services to gain access to the target account.
MITRE ATT&CK Mapping Technique ID Technique Applies To T1078.004 Valid Accounts: Cloud Accounts All three (post-compromise)
Besides PyPi, the functionality of EvilProxy also supports GitHub and npmjs ... enabling supply chain attacks via advanced phishing campaigns.
Resecurity has acquired videos released by EvilProxy actors demonstrating how it can be used to steal the victim’s session and successfully go through Microsoft 2FA and Google e-mail services to gain access to the target account.
The bad actors register similar (by spelling) domains with the intention of masking them under legitimate online-services.
Resecurity has acquired videos released by EvilProxy actors demonstrating how it can be used to steal the victim’s session and successfully go through Microsoft 2FA and Google e-mail services to gain access to the target account.
MITRE ATT&CK Mapping Technique ID Technique Applies To T1078.004 Valid Accounts: Cloud Accounts All three (post-compromise)
By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...
This allows the operator to capture passwords, MFA responses, and authenticated session cookies, potentially enabling account takeover even after the victim completes a conventional MFA challenge.
This way they can harvest valid session cookies and bypass the need to authenticate with usernames, passwords and/or 2FA tokens.
Advanced quishing combined with AitM proxies defeats standard MFA by stealing session tokens after successful authentication.
they aggregate data about known VPN services, Proxies, TOR exit nodes and other hosts which may be used for IP reputation analysis (of potential victims).
By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Adversary-in-the-middle phishing kit described as intercepting one-time codes and session tokens in real time.
A phishing-as-a-service adversary-in-the-middle kit that uses reverse proxying to steal credentials and authenticated sessions across a variety of services and sectors. The content describes it as broadly used and enabling low-skill actors.
Mentioned only as another AiTM phishing kit sharing hosting infrastructure with Kratos.
A phishing platform/kit referenced as one of the established services seeing increased campaign activity following the Tycoon 2FA disruption.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.