Threat actors are using the open-source phishing framework Evilginx to target universities across the United States, according to researchers at Infoblox. The attackers have targeted at least 18 universities and educational entities since April 2025, using phishing pages that spoofed student single sign-on (SSO) portals.
“In the campaigns we analyzed, students were targeted via personalized emails that contained TinyURL links,” Infoblox says. “These short links redirected to phishing URLs dynamically generated from Evilginx phishlets—configuration files that define how the proxy interacts between the victim’s device and the legitimate site.
“Each phishing URL used a subdomain that impersonated the target brand and a URI with eight random alphabetic characters (case-insensitive). The URLs expired within 24 hours, a tactic to limit exposure and evade detection. When victims accessed the phishing URL, Evilginx proxied the legitimate login flows in real time, making traffic appear normal and bypassing MFA.”
Notably, Evilginx has built-in measures that help its attacks avoid detection, allowing unskilled threat actors to launch sophisticated, evasive phishing campaigns.
“The low detection rates across the cybersecurity community highlight how effective Evilginx’s evasion techniques have become,” the researchers write.
“Recent versions, such as Evilginx Pro, add features that make detection even harder. These include default use of wildcard TLS certificates, bot filtering through advanced fingerprinting like JA4, decoy web pages, improved integration with DNS providers (e.g., Cloudflare, DigitalOcean), multi-domain support for phishlets, and JavaScript obfuscation. As Evilginx continues to mature, identifying its phishing URLs will only become more challenging.”
AI-powered security awareness training can give your organization an essential layer of defense against phishing and other social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 HRM+ platform to strengthen their security culture and reduce human risk.
Infoblox has the story.
