Evilginx Phishing Operation Targets 18 U.S. Universities, Bypasses MFA

Evilginx Phishing Operation Targets 18 U.S. Universities, Bypasses MFA

First seen 11 Dec 2025, 04:48 UTC •ScworldSecurityinfowatch •90% similarity •31.3

Article Content

Browse articles
ThreatCluster

A coordinated phishing campaign using the Evilginx toolkit has targeted at least 18 American universities, exploiting advanced session-hijacking techniques to bypass multi-factor authentication (MFA) and gain unauthorized access to student accounts. The operation, which ran from April to November 2025, involved personalized emails with TinyURL links that mimicked legitimate university communications.

ThreatCluster AI

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Burke Museum Of Natural History University Of California, Santa Barbara University Of California, Santa Cruz University Of Michigan University Of San Diego University Of Washington Phishing Evilginx TinyURL