A malicious mutation of the widely used nginx web server facilitates malicious adversary-in-the-middle attacks. Sophos X-Ops analyzed the criminal potential of Evilginx in a test setup and offers tips for protection.
Evilginx is a malware based on the legitimate and widely used open-source web server nginx. It can be used to steal usernames, passwords, and session tokens, and it offers attackers a way to bypass multi-factor authentication (MFA).
How Evilginx works
At its core, Evilginx leverages the legitimate and popular nginx web server to route web traffic through malicious websites. These websites are created by threat actors to mimic real services like Microsoft 365—a process known as an adversary-in-the-middle (AitM) attack. To demonstrate this attack tactic, Sophos X-Ops set up a malicious domain and a Microsoft phishlet with its own subdomain. The phishlet contains a decoy that the targeted user sees when the cybercriminals attempt to intercept usernames and passwords.
The forms and images the user sees actually originate from Microsoft and are forwarded to the user via the Evilginx server. However, Evilginx offers the ability to configure the user experience in the backend. In tests, Sophos X-Ops mimicked an MFA-protected user account and was able to bypass this hurdle immediately. The user experiences a "normal" login. Only when a particularly attentive user clicks on one of the applications on the left side of the screen might they notice something strange, as they are prompted to log in again.
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a monthIntercepting passwords, session tokens and cookies
In addition to intercepting usernames and passwords, session tokens are also captured. This is possible if the attacker selects the "Stay signed in" option when the Microsoft prompt appears. Evilginx stores this data in a database containing information about each session—including the public IP address used to access the server, the user agent used, and—most importantly—the cookie. This allows the attacker to simply open a window on the legitimate login page and import the cookie to log in as a legitimate user. From here, cybercriminals have full access to the user's mailbox account. Once the account is accessed, cybercriminals can reset MFA devices, change passwords, and perform a variety of other actions to gain advanced account access.
This is how you can protect yourself
To counter the danger of an Evilginx attack, two preventive and reactive measures are suitable.
As part of a reactive countermeasure, the first step should be to revoke the threat actor's access and completely close the door. This involves revoking all sessions and tokens across Entra ID and Microsoft 365 to remove the access gained. These actions can be performed in the user account in both Entra ID and Microsoft 365 using the "Revoke Sessions" and "Sign Out of All Sessions" buttons.
Next, the user's passwords and MFA devices need to be reset. Depending on the type of MFA device added, this may allow passwordless access to the account, rendering password changes and session removal ineffective.
Danger recognized, but not completely averted
Evilginx represents a formidable criminal method for bypassing MFA and compromising credentials. The existence of Evilginx also ensures that a complex attack technique is relatively easy to deploy, which could lead to widespread adoption. However, with the mitigations described, users have a good opportunity to significantly limit the success of an attack.
More at Sophos.com
About Sophos More than 100 million users in 150 countries trust Sophos. We offer the best protection against complex IT threats and data loss. Our comprehensive security solutions are easy to deploy, use and manage. They offer the lowest total cost of ownership in the industry. Sophos offers award-winning encryption solutions, security solutions for endpoints, networks, mobile devices, email and the web. In addition, there is support from SophosLabs, our worldwide network of our own analysis centers. The Sophos headquarters are in Boston, USA and Oxford, UK.