AiTM Phishing Framework Execution - Evilginx/Modlishka/Muraena

Ankit Mehta@Secvyn

•updated Jun 27, 2026•5•0•4

Detects the execution of known adversary-in-the-middle (AiTM) phishing frameworks, such as Evilginx or Modlishka, by identifying process names, paths, or specific command-line arguments (e.g., --phishlets, --proxy, --lure) used to initiate these proxy-based phishing sessions.