# One Misconfigured Server Exposes Three Live Evilginx Phishing Operations Targeting Microsoft 365
A simple operational mistake—leaving a Python web server running with directory listing enabled—has exposed the inner workings of three separate Microsoft 365 phishing campaigns, revealing how attackers are systematically bypassing MFA, harvesting credentials at scale, and monetizing stolen enterprise access. The discovery, made by French security firm Lexfo in April 2026, uncovered a sprawling ecosystem of fork-and-customize attack infrastructure built atop the open-source Evilginx proxy framework, operated by distinct threat actors across Africa and Europe.
What began as a routine internet scan of a single misconfigured host at 185.163.204[.]7 in Budapest spiraled into a chain of pivot points leading back to not one, but three active phishing operators, each running customized variants of the same core tool. The largest campaign had been running for over a year, targeting corporate Microsoft 365 mailboxes with alarming success.
## The Threat: A Directory Full of Confessions
The exposure started with a single misstep. An attacker running a live phishing operation executed the command python3 -m http.server 8080 and never cleaned it up—the command itself remained visible in the server's readable .bash_history file. With directory listing enabled, anyone who found the server gained unrestricted access to its contents.
What Lexfo discovered was damning:
Running on the same compromised host was both an Evilginx proxy server and a SimpleHelp remote console, providing the attacker with real-time access to compromised systems and ability to manage campaigns interactively.
## Understanding Evilginx: The Framework Behind the Attacks
Evilginx is an open-source, reverse-proxy-based phishing framework originally released by its creator "Kuba Gretzky" on GitHub. Rather than hosting a fake login page on an attacker-controlled server, Evilginx positions itself as a man-in-the-middle (AITM) between the victim and the legitimate Microsoft login servers. This architectural difference is critical—the attacker's infrastructure intercepts the victim's authentication attempt in real time, capturing not just the username and password, but also the session tokens generated during successful login.
The framework's power lies in its ability to:
The three operators discovered by Lexfo had each customized the framework differently, reflecting their distinct technical sophistication and target priorities.
## The Three Campaigns: Different Approaches, Shared Framework
### Campaign 1: codemado's MaDoO Operation (Egypt)
The largest and most aggressive of the three campaigns is attributed to codemado, an Egyptian threat actor with a history in VoIP forums and hacking communities since 2018. Lexfo tracked his operation running on the domain picis[.]net, with the live campaign launching on April 20, 2026, and continuing through at least late June—weeks after the initial exposure.
codemado's approach is straightforward and effective: he cloned existing Evilginx variants from public GitHub repositories, comparing multiple forks side-by-side to identify the best features for his deployment. His bash history revealed deliberate kit selection and testing. Rather than writing custom attack code from scratch, he integrated his Evilginx proxy with a bulk mailer tool he authored called MaDoO Blaster, allowing him to monetize stolen access by reselling corporate Microsoft 365 credentials to other threat actors.
Key operational details:
### Campaign 2: mail-argenta's red-queen Variant (Nigeria)
The second operator, mail-argenta, is a Nigerian threat actor whose Evilginx fork demonstrates significantly higher technical sophistication. His customized variant, tracked as red-queen, includes multiple anti-detection and capability enhancements:
| Modification | Purpose |
|---|---|
| Renamed crossorigin/integrity attributes | Defeats Subresource Integrity (SRI) checks |
| Custom URL-rewriting engine | Dodges path-based detection mechanisms |
| Pre-filled email addresses | Reduces victim abandonment rates |
| Extended cookie TTL (1 year / 31,536,000 seconds) | Session tokens remain valid even after password resets |
The last point is particularly dangerous: without a Conditional Access Engine (CAE)-capable policy in place, a stolen Microsoft session cookie captured by red-queen can remain usable for months, even if the victim resets their password immediately after discovering the breach.
mail-argenta's security was ultimately compromised through the very mechanism his phishing panels exist to exploit: his credentials were discovered in infostealer logs (harvested credential databases sold on underground marketplaces). The password found in those logs matched the hardcoded MySQL password in his Kraken phishing panel and was reused across multiple accounts.
### Campaign 3: saroula01's black-queen Variant (Unknown Attribution)
The third operator, saroula01, remains unidentified but operates the most technically interesting variant: black-queen. Unlike the other two campaigns, which rely on credential capture and password proxying, black-queen exploits Microsoft's OAuth device code flow—a legitimate authentication path designed for input-constrained devices like smart TVs, printers, and IoT devices.
The attack works by:
1. Generating legitimate device codes from Microsoft's authentication servers
2. Wrapping the codes in a fake Microsoft Authenticator interface
3. Deceiving users into approving the authentication request
4. Obtaining valid session tokens without ever capturing passwords
This approach is significant because it bypasses traditional MFA implementations that focus on password interception. A user can have a strong, unique password and still be compromised through the device code flow attack.
Despite remaining unidentified, saroula01's campaign generated far more credential captures than either codemado's or mail-argenta's operations, suggesting either broader targeting, higher success rates, or longer operational duration.
## How They Bypass MFA: Two Distinct Mechanisms
The three campaigns employ fundamentally different MFA bypass strategies, which is critical for defense:
Proxy-Based Bypass (codemado and mail-argenta):
Device Code Flow Abuse (saroula01):
These require different defensive controls, which is why understanding the distinction matters.
## Implications for Organizations
This exposure demonstrates several critical vulnerabilities in enterprise Microsoft 365 deployments:
The Phishing Problem Persists: Even with MFA enabled, proxy-based attacks remain viable because MFA validation happens on Microsoft's servers—from Microsoft's perspective, the attacker completing MFA is indistinguishable from a legitimate user.
Session Token Longevity: Session cookies with extended TTLs (like the one-year tokens in red-queen) create a persistent vulnerability window. Once stolen, they remain valid months after password resets, providing long-term dwell time for attackers.
Device Code Flow Abuse: Legitimate OAuth flows designed for convenience become attack vectors when users don't understand what they're approving.
Operational Scale: The discovery of three concurrent, distinct campaigns suggests this is not a fringe attack vector—Evilginx phishing against Microsoft 365 appears to be an established, profitable industry with multiple well-resourced operators.
## Recommendations for Defense
Organizations operating Microsoft 365 should implement layered defenses:
---
## HackWire Analysis
This incident exemplifies a quiet but accelerating transition in credential-compromise economics: phishing is no longer about individual account takeovers—it's become infrastructure-as-a-service. Three operators, three customized kits, one unified attack model. They're not competing; they're partitioning the market.
The most damaging detail isn't the directory listing itself—it's what came after. codemado kept running *after* the April 30 exposure, spinning up fresh subdomains and renewing wildcard certificates into June. That's not panic; that's confidence. The attacker calculated that exposure to French researchers wouldn't reach downstream defenders fast enough to matter. In most organizations, he was right.
What also matters: mail-argenta's compromise came through the exact pipeline his phishing panels create—harvested credentials in infostealer databases. He was caught by his own tool's byproduct. This is the secondary market problem. Stolen credentials become combolists, combolists seed marketplaces, and attackers who've monetized credentials become targets when those credentials re-circulate. There's no exit strategy in credential theft—only rotation to the next target.
The device code flow abuse (saroula01's black-queen) is the plot twist. It's not new—researchers have warned about this for years—but seeing it operationalized at scale against Microsoft 365 suggests that attacks have graduated from "password is the new password" to "any part of the OAuth flow is exploitable if the UI looks right." Microsoft Authenticator's phone sign-in feature, which explicitly requires the user to see *which device* is signing in, is the workaround that actually works—because it moves approval off the victim's compromised browser.
The lesson for security teams: MFA is not binary. Some implementations remain vulnerable to proxy attacks and token theft. Session lifetimes matter. Device code flows matter. The attacker isn't fighting you; they're routing around you.
— HackWire Editorial
---
## Related Coverage