DETECTION AND EVASION ANALYSIS OF MAN-IN-THE-MIDDLE PHISHING ATTACKS

Phishing remains one of the most prevalent cybersecurity threats, responsible for 36% of all data breaches in 2022. Man-in-the-middle (MITM) phishing toolkits represent an advanced class of attack that can bypass multi-factor authentication (MFA) by intercepting credentials and session tokens in real time through a reverse proxy. This paper presents a comprehensive implementation and empirical analysis of Evilginx3 version 3.2, a cutting-edge MITM phishing toolkit, deployed against two high-profile enterprise targets , Cisco Systems and Microsoft 365.

We identify and analyze four primary detection mechanisms applicable to MITM phishing toolkits: website fingerprinting, TLS fingerprinting, timing analysis, and URL validation. Our real-world experiment demonstrates that Evilginx3, operating with default configuration, evades detection by the majority of publicly available web scanners for the full four-week experiment duration in the case of the Cisco phishlet. The Microsoft 365 phishlet was detected inconsistently by only seven scanners, none of which escalated the site to a blocklist.

These findings reveal a critical gap in current phishing detection infrastructure and provide actionable insights for red teams and defensive security practitioners.