evilginx2
Software · ATTACK:enterprise:S9003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9003",
"title": "evilginx2",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--1eb9627d-a661-4db6-bf53-41b7dcc63087",
"external_id": "S9003",
"domain": "enterprise",
"created": "2026-01-30T20:15:05.674Z",
"modified": "2026-04-23T02:18:02.821Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Sophos Evilginx MAR 2025",
"url": "https://www.sophos.com/en-us/blog/stealing-user-credentials-with-evilginx"
},
{
"source_name": "Breakdev Evilginx 2.1 SEP 2018",
"url": "https://breakdev.org/evilginx-2-1-the-first-post-release-update/"
},
{
"source_name": "Evilginx 2 July 2018",
"url": "https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e95c694-902e-4d6c-b5bd-17888e426d55
Breakdev Evilginx 2.3 JAN 2019ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dc94895-c81e-4a83-865a-e53352f17395
Breakdev Evilginx 3.2 AUG 2023ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a749db3-cabf-4849-a9e4-a7ba21bfbd1f
Breakdev Evilginx 2.4 SEP 2020ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b5922d7-d1cf-4e5d-84c9-4e7e8ac4a6a5
Sophos Evilginx MAR 2025 · Evilginx 2 July 2018ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cdabda2-8895-45fb-bbb9-11733f347e27
Breakdev Evilginx 2.4 SEP 2020 · Breakdev Evilginx 3.3 APR 2024 · Evilginx 2 July 2018ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--719d58cc-72c9-44f9-9c4f-5a6d275eedfa
Sophos Evilginx MAR 2025 · Breakdev Evilginx 3.2 AUG 2023 · Breakdev Evilginx 3.0 May 2023 · Evilginx 2 July 2018ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1185
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7641ab63-39e1-4cd2-8e9c-9bd1ce6da370
Breakdev Evilginx 2.2 NOV 2018ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1111
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78b41d13-222f-4ab7-8bcd-af2e0e169a45
Evilginx 2 July 2018ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1132
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--840d01e8-e401-413b-bdc8-f47122c5661d
Breakdev Evilginx 2.4 SEP 2020ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1553.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2a81a97-a8ce-447b-9c8a-3029a96a7e65
Evilginx 2 July 2018ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3a71677-e8d4-4d56-8429-50c3ec8fac85
Sophos Evilginx MAR 2025 · Breakdev Evilginx 2.4 SEP 2020 · Evilginx 2 July 2018ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf5cb40e-9857-438c-8e57-26088a87e879
Sophos Evilginx MAR 2025ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6270a34-0a0b-456d-9857-f6fe0ec54ea8
Sophos Evilginx MAR 2025 · Breakdev Evilginx 2.3 JAN 2019 · Breakdev Evilginx 3.3 APR 2024ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc27cb61-8dcf-4cc6-b166-b6faf6504c21
Evilginx 2 July 2018