Russian Hackers Breach 20+ NGOs Using Evilginx Phishing via Fake Microsoft Entra Pages
Source Reddit InfoSec News
Germany
France
United Kingdom
Netherlands
Belgium
Sweden
Poland
Italy
Spain- infosecnews
- thehackernews.com
- phishing
- breach
- hack
- cybersecurity
Description
Russian Hackers Breach 20+ NGOs Using Evilginx Phishing via Fake Microsoft Entra Pages
Impact
For European organizations, particularly NGOs, this threat poses a substantial risk to confidentiality and integrity of sensitive information. NGOs often handle data related to human rights, political advocacy, and humanitarian efforts, making them attractive targets for state-sponsored or politically motivated attackers. Successful breaches can lead to exposure of confidential communications, donor information, and strategic plans, potentially undermining organizational missions and endangering individuals associated with these groups. The use of Evilginx to bypass MFA significantly increases the risk of unauthorized access, as traditional security controls may be insufficient to detect or prevent these intrusions. Additionally, compromised accounts can be used as footholds for further lateral movement within networks, leading to broader organizational compromise. The reputational damage and potential regulatory consequences under GDPR for data breaches further amplify the impact on European NGOs. Given the geopolitical tensions involving Russia and Europe, these attacks may also be part of broader intelligence or disruption campaigns targeting civil society organizations.
Defensive guidance
To mitigate this threat, European NGOs and similar organizations should implement advanced anti-phishing defenses beyond standard MFA. This includes deploying phishing-resistant authentication methods such as hardware security keys (e.g., FIDO2/WebAuthn) that are not susceptible to session hijacking. User education should focus on recognizing sophisticated phishing attempts, including verifying URLs and using out-of-band verification for sensitive logins. Organizations should enable conditional access policies that restrict access based on device compliance and network location. Monitoring for anomalous login behavior and session anomalies can help detect compromised accounts early. Implementing Security Information and Event Management (SIEM) solutions with behavioral analytics can provide alerts on suspicious activities. Regularly reviewing and revoking active sessions and tokens, especially after suspicious events, reduces the window of attacker persistence. Finally, organizations should conduct phishing simulation exercises tailored to advanced threats like Evilginx to improve user resilience.
- Source Type
- Subreddit
- InfoSecNews
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Domain
- thehackernews.com
Community reviews
Related threats
- Microsoft Teams to get AI-powered, context-aware phishing detectionNews
- Technology that blocks DGA domains | Kaspersky official blogAnalysis
- 2026 Year End Phishing LuresCampaign
- Machine speed attacks require machine speed detection and responseAnalysis
- How Tenable brought multi-language support to security detectors with agentic translationAnalysis