A report reveals that 18 American universities faced a coordinated phishing campaign from April to November 2025. Attackers used the Evilginx tool to bypass Multi-Factor Authentication and steal login credentials and session cookies, compromising user accounts. The University of San Diego was the first reported victim, and several other institutions were significantly affected.

OktaGinx is a phishlet designed for Evilginx that enables the bypassing of Okta authentication when used in conjunction with Azure. It incorporates techniques to evade framebusters, enhancing its phishing capabilities.