Over 70 Domains Used in Months-Long Phishing Spree Against US Universities
Overview
A phishing campaign utilizing the Evilginx kit has targeted 18 US universities, successfully bypassing Multi-Factor Authentication (MFA) to steal credentials over a period from April to November 2025. The severity of the threat highlights the vulnerabilities in MFA systems and the need for enhanced security measures in educational institutions.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: 18 US universities
- Action Required: Educational institutions should enhance their MFA systems, implement user training on recognizing phishing attempts, and consider additional layers of security such as anomaly detection and threat intelligence.
- Timeline: Ongoing since April 2025
Original Article Summary
Infoblox Threat Intel reports a campaign that used the Evilginx phishing kit to bypass Multi-Factor Authentication (MFA) and steal credentials from 18 US universities between April and November 2025.
Impact
18 US universities
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since April 2025
Remediation
Educational institutions should enhance their MFA systems, implement user training on recognizing phishing attempts, and consider additional layers of security such as anomaly detection and threat intelligence.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Phishing, Intel.