Listen to this Post
Introduction:
Modern authentication systems increasingly rely on Multi‑Factor Authentication (MFA) to block unauthorised access. Attackers, however, have moved beyond simple credential theft. Adversary‑in‑the‑Middle (AiTM) platforms such as Evil‑noVNC now allow cybercriminals to stream a live, fully interactive browser session directly into the victim’s browser, capturing credentials, MFA tokens and session cookies in real time—even when MFA is correctly completed.
Learning Objectives:
- Understand the technical architecture of Evil‑noVNC and the broader Browser‑in‑the‑Middle (BitM) attack vector.
- Identify the critical weaknesses of traditional MFA when faced with session token theft.
- Learn practical mitigation and detection techniques for both blue teams and end‑users.
You Should Know:
1. Technical Deep‑Dive: How Evil‑noVNC Works
Evil‑noVNC is a ready‑to‑go phishing platform that uses a real browser (usually Chromium) running inside a Dockerised virtual desktop environment. Unlike simple reverse proxies, it does not parse or alter HTTP traffic; instead, it provides the victim with a live remote desktop view of an authentic login page—e.g., Gmail, Microsoft 365, or Okta—hosted on the attacker’s infrastructure. The victim interacts with this “remote browser,” while the attacker silently observes every keystroke, every MFA code, and any saved autofill data. Because the victim is actually logging into the legitimate service, the authentication flow succeeds, and the attacker captures the resulting session cookie. Replaying that cookie grants persistent, MFA‑bypassed access.
Step‑by‑step guide to understanding the attack flow:
- Attacker Environment: A Linux host (Kali, Ubuntu, etc.) with Docker, Python3, and Chromium.
- Clone & Build: `git clone https://github.com/JoelGMSec/EvilnoVNC` followed by `cd EvilnoVNC && sudo chown -R 103 Downloads
andsudo docker build -t evilnovnc .`. - Launch the phish: `sudo ./start.sh 1920x1080x24 https://mail.google.com` creates a VNC session that streams the Gmail login page to a noVNC WebSocket endpoint.
- Deliver the link: The attacker sends the generated noVNC URL to the target (e.g., via email, QR code, or fake “security alert”).
- Victim interaction: The victim sees a pixel‑perfect Gmail login window, completes 2FA, and authenticates successfully.
- Token capture: The attacker extracts the session cookie (e.g., via browser developer tools or built‑in keylogger) and replays it in their own browser, gaining full account access.
Relevant Linux/Windows Commands & Code
On the attacker’s Kali / Ubuntu machine (setup and execution):
Install Docker (if not present) sudo apt update && sudo apt install docker.io -y Clone the Evil‑noVNC repository git clone https://github.com/JoelGMSec/EvilnoVNC cd EvilnoVNC Set proper permissions for the Downloads folder (required for Docker build context) sudo chown -R 103 Downloads Build the Docker image sudo docker build -t evilnovnc . Make start script executable sudo chmod +x start.sh Launch the attack (e.g., targeting Microsoft 365) sudo ./start.sh 1920x1080x24 https://login.microsoftonline.com
Session cookie extraction (once the victim has authenticated):
Inside the running container, cookies are often stored in: cat /home/user/.config/chromium/Default/Cookies Alternatively, use the built‑in keylogger logs in the EvilnoVNC directory
From a defender’s perspective (Windows): Use PowerShell to inspect running processes for any suspicious remote‑desktop or WebSocket connections:
Get-1etTCPConnection -State Established | Where-Object {$<em>.RemotePort -eq 5980 -or $</em>.RemotePort -eq 6080}
Network‑level detection: Monitor for WebSocket traffic (ws:// or wss://) on unusual ports (e.g., 5980, 6080, 8080) combined with high‑resolution screen‑share patterns.
2. Browser‑in‑the‑Browser (BitB) Illusion vs. Reality
Evil‑noVNC is often called a “Browser‑in‑the‑Browser” (BitB) attack because the fake login window appears to be a genuine browser pop‑up, complete with a realistic address bar and SSL padlock. However, unlike a classic BitB (which uses HTML/CSS to create a fake window inside the same page), Evil‑noVNC adds a full remote desktop layer, making it much harder to distinguish from a legitimate login experience.
Step‑by‑step guide to spotting the illusion:
- Window behaviour: Try to drag the “login window” outside the main browser area. A genuine OS window can be moved anywhere; a fake BitB window stays confined to the webpage boundary.
- Right‑click test: Right‑click inside the login form. A real browser pop‑up will show the native context menu. In Evil‑noVNC, right‑click is often disabled, and you may see a VNC client menu instead.
- URL bar persistence: The attacker’s noVNC URL does not change as you navigate. If the address bar remains
http://attacker‑domain.com:5980/vnc.html` while you are supposedly onmail.google.com`, you are inside a remote session. - Keyboard shortcuts: Try `Ctrl+S` or
Ctrl+T. In a real browser, they open save dialogs or new tabs. In a VNC‑streamed browser, they usually have no effect (or trigger the local browser’s own shortcuts, creating confusion). - Screen tearing / resolution mismatch: Resize your browser window. Remote desktop streams often exhibit screen tearing, artefacting, or a fixed resolution that does not adapt smoothly to resizing.
3. Weaponised Versions: EvilKnievelnoVNC and Scalable AiTM
The original Evil‑noVNC is a proof‑of‑concept, but threat actors have already created weaponised forks. EvilKnievelnoVNC adds concurrent sessions, auto‑blocking after successful authentication, an admin dashboard, real‑time victim monitoring, and the ability to overtake an authenticated session. It uses Docker containers, HAproxy for load balancing, and a Chromium extension to manipulate the target site (e.g., hiding hardware token options). This transforms a single phishing attempt into a scalable, semi‑automated MFA bypass campaign.
Setup and usage of the weaponised variant (for defensive research only):
git clone https://github.com/NIVEL4/EvilKnievelnoVNC-14 cd EvilKnievelnoVNC-14 Edit setup.sh to set your phishing domain, max instances, TLS certificate path, and admin password ./setup.sh After successful setup, launch the platform ./run.sh
Admin dashboard access: `https://your‑phish‑domain/phishboard` (with the basic auth credentials defined in setup.sh). From there, you can add target email addresses, generate unique victim‑specific URLs, and monitor live login attempts, captured credentials, and session cookies.
Detection note for blue teams: Look for anomalous TLS certificates (self‑signed or with CN=testing‑server), repeated GET requests to /phishboard, and unexpected WebSocket upgrades to paths containing /websockify.
- Why Traditional MFA Fails – Session Token Theft
Most organisations believe that MFA (SMS, TOTP, push notifications) stops account takeover. Evil‑noVNC demonstrates why this is dangerously false. The victim completes MFA successfully, and the attacker simply records the session token that the legitimate service issues after successful authentication. Replaying that token (e.g., by injecting it into a browser’s developer tools) grants the attacker full access without ever needing the password or MFA code again.
How session token theft works in practice:
- Victim logs in via the attacker’s VNC‑streamed browser.
- After MFA, the service sends a `Set‑Cookie` header containing a session token (e.g.,
PHPSESSID,ASP.NET_SessionId,AWSALB). - The attacker can inspect cookies inside the noVNC browser (
Right Click > Inspect > Application > Storage > Cookies) and copy the token. - Using a tool like EditThisCookie or simply pasting the token into the `document.cookie` field in their own browser console, the attacker assumes the victim’s authenticated identity.
This attack defeats:
- SMS and TOTP 2FA
- Push‑based approvals (e.g., Microsoft Authenticator, Duo)
- Hardware tokens (e.g., YubiKey) if the attacker can force a fallback to OTP
- Biometric logins (if the session token is replayed after the victim has already used biometrics)
Phish‑resistant MFA (e.g., FIDO2/WebAuthn) is not automatically safe either, because the attacker can downgrade the authentication method by manipulating the DOM or redirecting to a fake page that requests a less‑secure factor. Only strict origin binding and resident credentials can mitigate this, and even those are not foolproof in a BitM scenario.
5. Mitigation Strategies: Blue Team Hardening
Because Evil‑noVNC uses a legitimate browser session, traditional signature‑based anti‑phishing filters often fail. A dynamic, behavioural approach is required.
Conditional Access Policies:
- Restrict logins to known, compliant devices (Azure AD Join, Intune MDM, etc.) and trusted IP ranges.
- Enforce session timeout and token rotation every few hours, reducing the window of replay opportunity.
- Use continuous access evaluation (CAE) so that revoked sessions are killed in near‑real time.
Network and Endpoint Detection:
- Monitor for WebSocket connections to unusual ports (5980, 6080, 8080) and to domains not matching your corporate DNS.
- Inspect HTTP `Referer` headers for signs of referrer masking services (e.g.,
href.li). - Deploy a browser extension or endpoint agent that alerts when a remote desktop client (noVNC, Guacamole, TeamViewer) is loaded inside a corporate browser.
User Awareness (tailored to BitB):
- Teach users to “drag the login window”: if it cannot be moved outside the browser, it is a fake.
- Train them to verify the URL bar and try `Ctrl+T` – if it does not open a new real tab, something is wrong.
- Encourage use of a password manager that auto‑fills only on the exact, expected domain; it will not fill in a remote session that has a different origin.
6. For Red Teams: Ethical Use of Evil‑noVNC
Evil‑noVNC can be a powerful tool for authorised security assessments, testing an organisation’s susceptibility to advanced AiTM phishing. Its realistic simulation helps educate employees and validate detection controls.
Step‑by‑step ethical engagement guide:
- Authorisation: Obtain written permission from the target organisation, specifying the scope, duration, and any excluded accounts.
- Environment isolation: Run the attack in a test domain or a separate tenant if possible. Never use real production credentials.
- Customisation: Modify the start page (
EvilnoVNC/Downloads/vnc_light.html) to include a visible “SIMULATION” watermark or a confirmation dialogue that informs the user they are participating in a security test. - Monitoring: Use the admin dashboard (or EvilKnievelnoVNC’s real‑time view) to monitor interactions without storing actual credentials unnecessarily. Purge all captured data immediately after the engagement.
- Reporting: Provide a clear report that documents which users fell for the simulation, what data could have been stolen, and actionable recommendations for improvement.
Legal warning: Unauthorised use of Evil‑noVNC or any phishing framework is illegal in most jurisdictions. The tool’s author explicitly states: “Its use is exclusive for educational environments and/or security audits with the corresponding consent of the client. I am not responsible for its misuse”.
What Undercode Say:
- Evil‑noVNC represents a paradigm shift: authentication is no longer a question of “is the user legitimate?” but “is the user’s browser environment legitimate?” Traditional MFA assumes a trusted endpoint, which is precisely what this attack subverts.
- The most effective short‑term defence is a combination of conditional access (device + location) and user behaviour training focused on window‑dragging and shortcut tests. Long‑term, we need to move toward true phishing‑resistant authentication where session tokens are tightly bound to the specific browser origin (e.g., WebAuthn with origin verification). However, even that remains vulnerable if the attacker controls the entire browser viewport via BitM.
Prediction:
- -1 Because Evil‑noVNC and similar AiTM platforms lower the technical bar for session hijacking, we will see a sharp increase in account takeovers even in MFA‑protected environments throughout 2025‑2026.
- -1 Traditional MFA (SMS, TOTP, push) will be increasingly dismissed as “not enough,” forcing organisations to invest in more expensive, phishing‑resistant solutions (passkeys, FIDO2), widening the security gap between large enterprises and smaller businesses.
- +1 Defensive tooling will evolve to include real‑time behavioural analysis of browser‑in‑the‑middle indicators, and platforms like Microsoft Defender for Identity will add automated detection of noVNC websocket patterns.
- +1 Red teams and security awareness vendors will adopt Evil‑noVNC as a standard simulation method, significantly improving employee preparedness against next‑generation phishing.
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Evil Novnc – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
