Evilginx MFA Bypass Session Token Capture

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•5

This rule detects potential MFA bypass attempts using Evilginx by looking for HTTP POST requests to the server that contain both 'session' and 'token' in the URI, with a body size greater than 100 bytes. This pattern is indicative of session token capture, a technique used by Evilginx to bypass multi-factor authentication.