CampaignPublished 3 Dec 2025Updated 1 Jan 2026

DNS Uncovers Infrastructure Used in SSO Attacks

Source AlienVault OTX General

Description

The threat actor leveraged Evilginx (likely version 3.0), an open source, advanced phishing adversary-in-the-middle (AITM, aka MITM) framework designed to steal login credentials and session cookies. Evilginx is widely used by cybercriminals to undermine multi-factor authentication (MFA) security, and this actor has used it to target at least 18 universities and educational institutions across the United States since April 2025. The campaigns were delivered through email and the phishing domains used subdomains that mimicked the legitimate SSO sites.

Impact

For European organizations, especially those in the education sector or any entity relying heavily on SSO authentication, this threat can lead to significant credential compromise and session hijacking. The attacker’s ability to bypass MFA undermines one of the strongest layers of defense, increasing the risk of unauthorized access to sensitive data, intellectual property, and internal systems. Compromised credentials can facilitate lateral movement within networks, data exfiltration, and potential disruption of services. The reputational damage and regulatory consequences under GDPR for data breaches involving personal data are also considerable. Given the phishing delivery vector, widespread user susceptibility could amplify the impact. The threat is particularly concerning for institutions with large user bases and less mature phishing detection capabilities. Additionally, the use of DNS infrastructure for attack delivery suggests that organizations with insufficient DNS monitoring and filtering may be more vulnerable. The medium severity rating reflects a balance between the sophisticated attack method and the requirement for user interaction (phishing click), meaning that while impactful, the threat is not trivially exploitable at scale without user engagement.

Defensive guidance

1. Implement advanced phishing detection and email filtering solutions that can identify and block emails containing malicious links or domains mimicking legitimate SSO services. 2. Conduct targeted user awareness training focused on recognizing phishing attempts, especially those impersonating SSO login pages. 3. Deploy DNS monitoring and filtering tools to detect and block access to suspicious subdomains and domains used in these campaigns. 4. Enforce strict domain and subdomain registration monitoring to identify potential lookalike domains early. 5. Utilize browser isolation or anti-phishing browser extensions that can detect and warn users about man-in-the-middle proxy attacks. 6. Implement anomaly detection on authentication logs to identify unusual login patterns or session behaviors indicative of session hijacking. 7. Consider adopting hardware-based MFA tokens or FIDO2/WebAuthn standards, which are less susceptible to session cookie theft. 8. Regularly review and update incident response plans to include scenarios involving AITM phishing attacks. 9. Collaborate with DNS providers and threat intelligence services to share indicators of compromise and block malicious infrastructure proactively. 10. Encourage the use of zero-trust network architectures that limit the impact of compromised credentials.

Indicators of compromise

Domains 67

acmsquared.com
ads2ads.com
aghomesandproperties.com
allwebdirectories.com
amj-international.com
apartamentosmalaga.com
armingaud.com
bazmepaigham.com
bedrijvenregister.com
bestshayari.com

IP addresses 15

160.153.178.199CC=US ASN=AS20773 host europe gmbh
162.0.228.151CC=US ASN=AS22612 namecheap inc.
192.169.177.165CC=US ASN=AS398101 godaddy.com llc
132.148.74.178CC=US ASN=AS398101 godaddy.com llc
160.153.176.197CC=US ASN=AS20773 host europe gmbh
162.0.214.254CC=US ASN=AS22612 namecheap inc.
199.192.23.40CC=US ASN=AS22612 namecheap inc.
203.161.60.59CC=US ASN=AS22612 namecheap inc.
208.109.244.86CC=US ASN=AS26496 godaddy.com llc
208.109.39.196CC=US ASN=AS398101 godaddy.com llc

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Dec 2025, 18:14 UTC

MITRE ATT&CK techniques3 from threat tags

Technical details

Indicators of compromise

Domains 67

IP addresses 15

Community reviews

Related threats