A reverse proxy phishing kit used to turn a legitimate sign in flow into a credential theft operation. It relays traffic to the real site, captures login details and one time codes, and helps attackers bypass defenses that rely on the appearance of a normal authentication page.
How Evil Proxy Works
Evil Proxy sits between the victim and the real sign in service, forwarding the page and responses so the phishing flow looks legitimate while credentials and session material are captured. The attacker does not need to recreate the entire brand experience from scratch, because the kit is designed to inherit the trust of the original login journey.
That relaying step is what makes the technique effective. It preserves the normal appearance of the authentication page, while still allowing the attacker to observe the values that matter for account access, including credentials and one time codes.
Why It Bypasses Common Defenses
The technique is especially effective against controls that assume users will notice a fake login page or that a one time code alone is enough to stop phishing. By using the real site as part of the interaction, the proxy can defeat weak visual detection, capture MFA responses in transit, and reduce the value of simple lookalike-site heuristics.
It also exploits the fact that many authentication defenses focus on the page a person sees, not the trust relationship being abused behind the page. If the attacker can relay a real session in real time, the victim may complete authentication against the genuine service while the attacker harvests reusable access material.
What Makes It Operationally Dangerous
Evil Proxy is dangerous because it turns a single sign in event into a reusable access path. Once the attacker captures credentials and session-related data, they can often reuse that access quickly, before the victim or security team notices anything unusual.
It also compresses the window for detection. The flow can look like normal authentication activity from the outside, which makes alerting based only on page appearance or basic login success much less reliable.
For defenders, the key security implication is that the real problem is not just spoofed branding, it is the abuse of trust during an authentic-looking exchange. That means the strongest countermeasures are those that bind authentication to the device, origin, or phishing-resistant factor, rather than only to a code entered by the user. See NIST SP 800-63 Digital Identity Guidelines for phishing-resistant authentication guidance, and OWASP API Security Top 10 for the downstream abuse of captured access when tokens or sessions are exposed.
How Practitioners Should Think About Detection And Response
Detection should look for suspicious authentication paths, unusual session characteristics, and login events that do not match the normal device or network context. Because the proxy preserves much of the legitimate flow, weak indicators such as URL similarity are rarely enough on their own.
OWASP Non-Human Identity Top 10 is useful here because modern incident response often has to account for the broader lifecycle of secrets, tokens, and other identity material after a compromise. If Evil Proxy has captured usable access, responders need to assume the attacker may move quickly from initial theft to reuse, persistence, and privilege expansion.
Risk and Threat Considerations
Evil Proxy creates a direct credential theft and session hijacking risk because it can relay a real authentication flow while extracting the material needed for later abuse. The danger is not only initial compromise, but the speed with which stolen access can be reused before challenge checks or user awareness catch up.
Failure mechanism: The kit relies on real-time man in the middle relaying, so the victim authenticates against the legitimate service while the attacker captures reusable secrets, codes, or session state.
Impact: Attackers can bypass weak MFA expectations, take over accounts, and pivot into downstream systems that trust the compromised session or identity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Phishing-resistant authenticators — Phishing-Resistant Authenticators | Evil Proxy defeats weak MFA by relaying authentication through the real site. |
| Recommendation — Adopt phishing-resistant authenticators to bind login to the genuine origin and block relay-based credential capture. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secrets and Credential Management | Captured codes, tokens, and session material become reusable identity material after proxy phishing. |
| Recommendation — Protect and rapidly rotate exposed secrets and tokens to limit reuse after relay-based theft. | ||
| MITRE ATT&CK | T1566 — Phishing | Evil Proxy is a phishing kit that delivers credential theft through a legitimate-looking sign-in flow. |
| Recommendation — Detect and disrupt phishing delivery paths that lead users into real-time credential and session capture. | ||
| CIS Controls v8 | 6.3 — Access Granting and Revoking | Captured login material can grant unauthorized access until access is revoked or reset. |
| Recommendation — Revoke exposed access quickly and reset affected credentials after confirmed phishing compromise. | ||
| NIST CSF 2.0 | PR.AA-02 — Identity Management, Authentication and Access Control | The term centers on authentication trust being abused during sign-in. |
| Recommendation — Strengthen authentication assurance so access decisions depend on verifiable identity signals, not page appearance. | ||
Practitioner Guidance
Why practitioners should care: Evil Proxy is a reminder that phishing resistance is an authentication design issue, not just a user-training issue. If a control can be replayed through a proxy, the organisation may have a false sense of protection even when MFA is present.
Practitioner takeaway: Prioritise phishing-resistant authentication and monitor for anomalous session behaviour, because the most damaging part of an Evil Proxy event is often the authenticated access that follows the theft.
