evilginx2 can modify the Origin and Referrer fields in HTTPS headers it relays between intended victims and legitimate websites to comply with cross-origin resource sharing (CORS) restrictions.4
tool
evilginx2 S9003
- Type
- tool
- Platforms
- IaaS, Identity Provider, Office Suite, SaaS
- Created
- 30 January 2026
- Last modified
- 23 April 2026
evilginx2 is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. evilginx2 can be used as a reverse proxy between victims and legitimate web services to intercept and capture credentials, authentication tokens, and session cookies.[1][2][3]
14
Techniques61st pct
8
TacticsTop 20%
0
Threat groupsNone recorded
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference S9003
evilginx2 can capture information from each session with a victim including the public IP used to access the server and the user agent.5
evilginx2 can inject JavaScript code into HTML content to customize phishing attacks.6
evilginx2 can proxy HTTPS connections between victims and destination websites.789
evilginx2 can route traffic via SOCKS5 and HTTP(S) proxies between an intended phishing victim's machine and legitimate websites.101112
evilginx2 can intercept authentication tokens to enable bypass of non-phishing resistant forms of MFA.13
Standing S9003
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques1461st pct
61st percentile · 61% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
Tactics8Top 20%
80th percentile · 80% of 825 ATT&CK software entries have this many tactics spanned or fewer.
Threat groups061% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique3medBottom 3%
3rd percentile · 97% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique0med
Detection coverage S9003
160 distinct rules cover the 14 techniques recorded for this tool. The 162 technique-to-rule mappings resolve to 160 distinct rules, because one rule can cover several techniques. 110 Sigma · 50 Splunk.
11 covered by at least one rule3 with no coverage160 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org