New Phishing Kits Use Open-Source Tools to Bypass MFA
KnowBe4, Friday, July 31st, 2026
Researchers track three phishing kits built on the open-source Evilginx framework to proxy live Microsoft 365 sessions.
Researchers at Lexfo are tracking three sophisticated phishing kits built from open-source components, primarily the publicly available adversary-in-the-middle framework Evilginx.
The kits proxy live Microsoft 365 authentication sessions to capture session cookies, which lets attackers bypass multi-factor authentication entirely rather than defeating it.
Because the victim authenticates against the genuine Microsoft endpoint, the session is legitimate from the identity provider's perspective. KnowBe4 covers how the kits are deployed and what signals still expose them. The post includes guidance on phishing-resistant authentication.