Infoblox published a fantastic writeup of a recent widespread phishing/Evilginx campaign against universities. As the article notes, discovering the entire attack surface is very difficult. I recommend all academic institutions have a look for these indicators.

#ThreatIntel #ThreatIntelligence

https://blogs.infoblox.com/threat-intelligence/dns-uncovers-infrastructure-used-in-sso-attacks/