EvilGinx Credential Harvesting Detection

Luis Zavier Guzman Garcia@KillBillKill98

•updated Sep 17, 2025•12•1•241

This rule detects network connections to known EvilGinx phishing infrastructure, identified by specific remote URLs, IP addresses, and a suspicious login URL pattern. EvilGinx is a phishing framework used for credential harvesting and session cookie theft, often employing adversary-in-the-middle techniques.