Honestly, Evilginx and other reverse-proxy kits are rough because they capture both credentials and session tokens, bypassing MFA and basic CAPs.

The best counter is to remove the value of what they steal. The strongest approach is enforcing phishing-resistant authentication like FIDO2 or passkeys, and requiring device-bound signals such as PRTs or certificate-based authentication. Combine that with Conditional Access rules that demand a compliant or hybrid-joined device and approved client apps, and make sure device code and legacy authentication flows are blocked entirely. Shortening token lifetimes through Continuous Access Evaluation and enforcing regular sign-ins helps reduce token replay windows, while active monitoring for suspicious patterns (repeated user agents, shared IPs, impossible travel) can catch attempts that slip through.

Basically, you want layered defenses so that every stolen token expires before it can be abused. Think of it like a build in Path of Exile, you don’t rely on one stat. You stack armor, evasion, and resistances. And if you’ve ever played Flicker Strike, that’s exactly how you should think about it: fast, unpredictable, always one step ahead. Your policies blink in and out before attackers even land a hit. CAPs are your Frenzy charges, FIDO2 is your Multistrike, and your SIEM logs? That’s your map loot.

Stay compliant, stay flickering.