Misconfigured Server Exposes Three Evilginx Phishing Operations Targeting Microsoft 365

An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing enabled, exposing the entire toolkit. French security firm Lexfo leveraged this misconfiguration to uncover three distinct phishing campaigns, each using a custom fork of the open-source Evilginx proxy. The largest campaign had been active for over a year, primarily targeting corporate mailboxes.

The three operations bypassed multi-factor authentication (MFA) in two distinct ways: one via adversary-in-the-middle (AiTM) proxy, and another by abusing Microsoft’s legitimate OAuth device code flow. The AiTM approach can be mitigated with phishing-resistant MFA like FIDO2 or passkeys, while device code abuse requires blocking the flow via Conditional Access policies. Continuous Access Evaluation (CAE) and IP-based location policies add further protection.

The operator behind the largest campaign, tracked as codemado, is an Egyptian actor active since 2018, running a platform on picis[.]net and monetizing access via a bulk mailer called MaDoO Blaster. A second operator, mail-argenta from Nigeria, developed the red-queen Evilginx fork with advanced evasion features. The third, saroula01, built the black-queen fork exploiting device code flow, capturing 218 accounts across 12 countries over a year, 94% corporate. All three showed signs of AI-assisted development, with code co-authored by Claude models or generated via APIs like CyberNeurova.

Defenders are advised to block device code flow where not needed, enforce Conditional Access policies, monitor for refresh-token grants from the Microsoft Office client ID d3590ed6-52b3-4102-aeff-aad2292ab01c, and hunt for RMM tools like XEOX used for persistence. The report underscores that the barrier to entry for such attacks has dropped to near zero, with public repositories and AI tools enabling widespread credential theft.