Cybercriminals increasingly use EvilProxy phishing kit for targeted account takeover attacks, compromising thousands of Microsoft 365 user accounts, with C-level executives accounting for almost 39% of compromised users. The phishing kit exploits sophisticated techniques to bypass multi-factor authentication and is available as a subscription service, highlighting the need for enhanced security measures.

EvilProxy is a platform for phishing-as-a-service that uses reverse proxies to intercept authentication requests and user credentials between the user (target) and the legitimate service website. By proxying the legitimate login form, the phishing server can steal authentication cookies once a user logs into their account. In addition, the stolen cookie enables the threat actors to bypass multi-factor authentication since the user has already passed MFA challenges when logging into an account.