Attackers have a new way to slip past your MFA

Attackers are using a tool called Evilginx to steal session cookies, letting them bypass the need for a multi-factor authentication (MFA) token, Malwarebytes reports. Researchers are warning about a rise in cases where this method is used against educational institutions, according to Infoblox.

Evilginx sits between you and the real website as an attacker-in-the-middle phishing toolkit, relaying the genuine sign-in flow while capturing your username, password and MFA code, and it can reuse the captured session cookie to impersonate you without triggering another MFA prompt. The attack flow involves a fake page that mirrors a legitimate site, where you enter credentials and MFA, with the proxy granting access and setting a valid session cookie.

To stay safe, use phishing-resistant MFA where possible, keep real-time anti-malware protection up to date, and revoke sessions if you notice anything suspicious. 3 December 2025