DNS Uncovers Infrastructure Used in SSO Attacks

A sophisticated threat actor has used the Evilginx adversary-in-the-middle phishing framework to bypass multi-factor authentication and compromise student SSO portals at at least 18 U.S. universities, evading traditional security measures but leaving detectable DNS fingerprints that enable ongoing tracking and protection.