Man-in-the-middle proxy

Evilginx is a Go-based adversary-in-the-middle phishing framework that proxies authentication traffic and can capture submitted credentials and session cookies or tokens. A stolen session can let an attacker replay an authenticated session and can bypass MFA methods that are not phishing-resistant; it does not defeat every MFA method. Use only in an authorized, isolated test environment with synthetic accounts and controlled domains.