Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials and session cookies to bypass two-factor authentication. The tool operates as a standalone application written in Go that implements its own HTTP and DNS servers, positioning itself between a victim's browser and the target website to intercept authentication data. This approach eliminates the complexity of the original Evilginx, which relied on a custom nginx configuration, making deployment and operation significantly simpler.
The framework addresses the challenge of harvesting both credentials and session cookies in a single attack, which enables attackers to maintain authenticated access even when two-factor authentication protects the target account. By acting as a transparent proxy, the tool can capture the full authentication flow and extract the session material needed to impersonate the victim after login.
Adoption of this tool is appropriate only for authorized penetration testing engagements with explicit written permission from the organizations being tested. The framework includes phishing detection evasion capabilities, an official phishlets database for targeting specific services, bot protection mechanisms, JavaScript and HTML obfuscation, wildcard TLS certificate support, and SQLite database integration. Organizations evaluating defensive measures against sophisticated phishing attacks should understand this tool's capabilities to properly assess their exposure.
Development activity shows consistent maintenance and feature expansion, with the project receiving updates that address emerging detection mechanisms and add new evasion techniques. The maintainer has invested substantial effort in building complementary offerings including a commercial Pro version and a dedicated training course, indicating ongoing commitment to the project's evolution. The tool remains actively developed with focus on keeping phishing detection evasion current against browser protections and other defensive measures.
