Evilginx Adversary in the Middle Phishing

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•6

This rule detects potential adversary-in-the-middle (AiTM) phishing attempts, specifically those leveraging tools like Evilginx. It triggers on HTTP requests where the URI contains the keywords "verify", "session", and "token" (case-insensitive). This combination of keywords in the URI is indicative of phishing pages designed to capture session tokens or verification codes.