GitHub RadarRed team tool

cfs0x/EvilHooked

This is a commercial graphical framework (web control panel) designed to automate, deploy, and manage advanced AitM (Adversary-in-the-Middle) phishing campaigns. Primary language: JavaScript. 6 stars.

JavaScript6 stars2 forkspushed Jul 24, 2026

Project links:Open GitHub project Back to radar

README Preview

Fetched from GitHub

<h2 align="center">EvilHooked</h2>

<img src="https://github.com/user-attachments/assets/4e9097f6-b51c-4db7-aeb8-8958b73c8f4d" alt="jsdelivr-logo" width="312px" height="512px"/> This is a commercial graphical framework (web control panel) designed to automate, deploy, and manage advanced AitM (Adversary-in-the-Middle) phishing campaigns. The program acts as a visual add-on to the popular Evilginx security tool, complementing it with its own automation modules based on Node.js ( EvilPuppet) and Playwrightto bypass modern corporate security systems (MFA/2FA, Captcha ( different types ) Cloudflare, etc).

<a href="https://rproxylab.gitbook.io/evilginx-lab-by-cfs0x/">RProxy Docs</a>   |   <a href="https://github.com/cfs0x/EvilHooked">EvilHOOKED</a>   |   <a href="https://t.me/EvilHooked">EvilHOOKED Channel</a>

Update: A PWA module has been added, allowing you to install desktop applications—phishlets ( Android / IOS / PC / MacOS). You can edit them in Live mode and replace them with downloads of other sites and applications (for example, when installing a PHISHLETs from Metamask on a desktop or mobile device, you can later replace it with a custom wallet application with full capture)

https://github.com/user-attachments/assets/c327f587-f5f8-406c-9a65-e68221d276c4

Added: We implemented FAKE notifications when working with targeted targets,

Installing file extensions inside the session - downloading from both the server and the extension store + the Evil extension itself for capturing browser data.

Main modules and functionalities

#Added: ⚡️ PRO UPDATE: BULLETPROOF AUTOMATION FOR EMAIL

https://github.com/user-attachments/assets/e609fb93-4dd2-4290-8400-da477e75bf15

Central hub for monitoring ongoing attacks in real time.

Metrics Counters: Displays the total number of sessions (Total Sessions), the number of successful compromises with data collection (Captured), unsuccessful attempts (No Capture), and the counter of active users on phishing pages.
Captured Sessions: An interactive table for managing intercepted sessions with filtering by phishlets and a button for exporting logs to CSV format.
Geo-Analytics: A built-in interactive world map (Users By Country) distributes victim traffic by country with the ability to filter for different time periods (current/previous month and year).
Live Capture Feed: A live activity feed for instantly tracking user activity on the target node.

Basic Evilginx Configurations

The interface completely replaces the need to manually edit configuration files via the Linux console.

Network settings: Manage the primary domain (Domain), external IP address, and ports for DNS (53) and HTTPS (443).
SSL management: Automatic issuance of Wildcard certificates (Autocert) for dynamic support of any subdomains.
Infrastructure masking: The Unauth URL setting determines where the user (or the security scanner) will be redirected if they are not authorized or blocked (for example, to a legitimate YouTube video).
Filtering: Select a blacklist mode (Blacklist Mode: unauth) to filter out unwanted traffic.

Integration with newsletters (Gophish & Spam)

The module connects the traffic interception infrastructure with email delivery tools.

Gophish Integration: The panel connects directly to the Gophish server API (Server URL, API Key).
Campaign Management: Automatically import, launch, and synchronize phishing campaigns.
Email Templates: Built-in manager for uploading and editing email templates (Spam / Email Templates).

Advanced functionality (PRO mode)

The PRO section transforms the standard Evilginx into a comprehensive platform for conducting complex Red Teaming operations at the Enterprise level.

Okta PRO Tweaks: A specialized module for bypassing the security of Okta, one of the largest authentication providers. It includes a stealth mode (No - stealth), which removes obvious phishing suffixes from the address bar, and the creation of OIDC redirects.
PhishForge Scanner (Automatic Generator): an automated scanner of target websites. Allows manual (Manual Login) or headless background (Automatic Background) opening of the Chrome browser directly on the server. This is used for manually solving captchas, bypassing Cloudflare protection, and performing deep web capture. Supports HTTP proxy operation. Creates Phishlets of any complexity with full bypass of all security systems. We write Phishlets for EVILGINX versions 3.x.x (before our modifications).
EvilPuppet / Playwright: Integration with the Playwright automation engine and a Node.js bridge script. Used as a sidecar to automatically intercept session cookies and instantly transfer them to an external session manager (Session Manager URL) for persistence in the victim's account.
JS_Inject Library: a tool for injecting arbitrary JavaScript code into the HTML of target pages on the fly. It allows for modification of the DOM tree, forced display of hidden elements (e.g., hidden Okta login forms), spoofing credentials, or collecting additional data from the victim's browser.
Intercept Rules: a module for creating rules to "short-circuit" (block) HTTP requests before they are sent to the real server. It's used to block security telemetry, antivirus sandboxes, and bots by immediately returning fake 403 errors, custom JSON responses, or 302 redirects.
Rewrite Rules: a flexible tool for automatically replacing text content or HTTP headers in the response body (response_body) with regular expression support (Regex). Allows you to customize original pages (change phone numbers, instructions, links).
Flow Engine Overrides: fine-tuning the proxy engine. Includes CORS Credentials management for seamless proxying between different domains, stripping CSS URL Canary links from styles to hide the proxy from security systems, and sending important event notifications via Webhook.
User-Agent Manager & Help: Manage unique browser identifiers for different phishlets and a built-in interactive help hub for all PRO platform features.

DNS (Wildcard DNS) Allows you to create subdomains on the fly without having to restart the Nginx web server. The Auto DNS on Startup feature automatically sets up DNS records when the panel starts, using the specified internal network adapter (in this example, 172.18.0.2).

Flow (Flow Engine Overrides)

Fine-tuning network interactions:

CORS Credentials (Enabled) — Allows the transfer of cookies and authorization headers between different domains.
CSS URL Canary (Enabled) — Automatically strips hidden "canary" links from CSS styles, which security systems use to detect phishing proxies.
Dynamic Host Log — Logs all dynamic client hosts.
Flow Webhook URL — A field for sending network logs to external SIEM/alert systems.

Help & Updates

Help (Pro Feature Reference) — tiled interactive documentation with a reference for all PRO features.
Updates / Modify — modules for checking Node.js/Playwright versions, updating components in one click, and changing the panel's digital signatures (Modify) to hide software from intrusion detection systems (EDR/NDR).

ADVANCED SPAM ENGINE (Phishing Email Generation)

An advanced email automation module designed for cloning and customizing legitimate corporate notifications.

Full-fledged brand cloning (Company Cloning):

The tool allows you to import an original company email (for example, a system notification from Okta, Microsoft 365, or an internal HR system and and others) in one click.
The engine automatically parses HTML code, pulls in official logos, fonts, and styles, creating a pixel-perfect copy of the original message.

Automatic link substitution:

The system automatically scans the imported email, finds all legitimate links, and replaces them with generated target lures (Lures) linked to Evilginx reverse proxy servers.

Randomization and spam filter bypass:

An integrated dynamic tag generator allows you to insert unique identifiers, employee names, custom subjects, and invisible text markers to successfully bypass email security systems (SEG/Spam filters).

ANTI-DETECT BROWSER AUTOMATION (Session Management)

A unique module for seamless management of compromised accounts without manual data import.

Automatic profile creation:

Once the EvilPuppet module successfully intercepts a valid session (MFA cookies and tokens), the platform automatically makes an API call to the integrated anti-detect browser (e.g., AdsPower, Multilogin, Dolphin{anty}).
The system instantly creates a new, isolated digital profile for that specific victim.

Seamless transfer without cookie manipulation:

All intercepted session data, cookies, and the browser's unique digital fingerprint (Canvas, WebGL, WebRTC, User-Agent) are automatically baked into the created profile.

Instant access:

The Red Team operator no longer needs to manually copy JSON/Netscape cookies or use third-party extensions.
Simply launch the generated profile in the anti-detect browser at any time: the target website will immediately open in an authorized state, completely bypassing repeated security checks and the risk of session resets.

Full Logging & Audit

A module for total control over the state of the infrastructure, ensuring maximum transparency of actions for analytics.

Server Logs (OS & Infrastructure Logs):

Monitor system resources, network interfaces, Docker containers, incoming connections on ports 53 (DNS) and 443 (HTTPS), and attempts to unauthorizedly scan the server itself.

Platform Logs (EPROXY LAB Logs):

Detailed audit of operator actions within the web panel, recording of changes to settings, JS injection logs, and Playwright automation script execution statuses.

Evilginx Core Logs:

Direct output of console logs from the original Evilginx to the web interface.
Allows real-time monitoring of the AitM connection establishment process, victim authorization steps, phishlet triggers, and the exact moment of token interception.

MULTI-CHANNEL ALERTS (Notification System):

A module for instantly alerting the team about important stages of compromise.

Telegram Integration:

Configure alerts via a Telegram bot.
The operator receives an instant push notification with details (which phishlet was triggered, the victim's login, and the cookie interception status).

Email Alerts:

Send critical reports to the team's secure email inboxes for long-term archiving of successful operations.

External Server (Webhook/SIEM):

Send structured JSON logs to a remote data collection server or to a corporate SIEM system to record timings as part of legitimate Red Teaming testing.

COMMAND & CONTROL SERVER (Teamwork)

A centralized management server that transforms a standalone tool into a fully-fledged platform for information security specialists to collaborate.

Deploy campaigns from a single center:

The command server allows you to remotely deploy configurations, launch new phishing campaigns, distribute domains, and manage a pool of proxy servers from a single panel.

Internal Chat and Communication:

An integrated communication panel for operators, allowing them to coordinate actions in real time directl