Light

Episode #888 Quiz

The EvilProxy Service
Date: 2022-09-13 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

EvilProxy is a turnkey Phishing-as-a-Service platform that uses transparent reverse proxies and cookie injection to steal usernames, passwords, session cookies, and one-time MFA tokens from targets visiting spoofed login pages. Hosted via Tor, it offers point-and-click campaigns, customer vetting, and per-period subscriptions, enabling account takeover and supply-chain compromise.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the key operational reason EvilProxy was so dangerous compared with earlier, harder-to-use attack tooling, according to the episode?

Question 1

What was the key operational reason EvilProxy was so dangerous compared with earlier, harder-to-use attack tooling, according to the episode?

It packaged phishing into a turnkey, point-and-click service that required little attacker skill. It relied on a novel browser bug that let attackers read passwords directly from memory. It worked only against old passwords and was blocked by any modern multifactor method. It depended on compromising upstream identity providers before any phishing could begin.

Question 2: Which authentication elements did EvilProxy claim to bypass by proxying the victim's login session?

Question 2

Which authentication elements did EvilProxy claim to bypass by proxying the victim's login session?

SMS codes, OAuth logins, and time-based one-time tokens. Hardware TPM attestations, Kerberos tickets, and SSH keys. Biometric scans, smart-card PINs, and recovery email approvals. Password managers, browser cookies, and DNS-based verification.

Question 3: How did EvilProxy obtain the victim's credentials and session material during a phishing attack?

Question 3

How did EvilProxy obtain the victim's credentials and session material during a phishing attack?

It used a transparent reverse proxy that fetched the real site and snarfed the traffic in transit. It brute-forced the account after capturing the victim's email address from headers. It exploited a server-side template flaw to dump the authentication database. It injected code into the browser to read the password field after submission.

Question 4: What pricing model did the EvilProxy control panel show for access to the service?

Question 4

What pricing model did the EvilProxy control panel show for access to the service?

30 days for $50, 60 days for $100, and 90 days for $150. Lifetime access for $400, with optional support sold separately. 10 days for $150, 20 days for $250, and 31 days for $400. 7 days for $100, 14 days for $200, and 30 days for $300.

Question 5: Which combination of platforms was explicitly called out as supported by EvilProxy for phishing targets?

Question 5

Which combination of platforms was explicitly called out as supported by EvilProxy for phishing targets?

Salesforce, Atlassian, and ServiceNow. Reddit, Discord, and Stack Overflow. Signal, Telegram, and WhatsApp. PyPI, GitHub, and npmjs.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.