Misconfigured Server Exposes Three Evilginx Phishing Campaigns

A server with directory listing enabled revealed the full arsenal of three phishing operators targeting Microsoft 365 accounts using distinct MFA-neutralization techniques. The discovery, published in late July by French security firm Lexfo, documents how a basic operational error on attack infrastructure allowed reconstruction of a criminal ecosystem employing sophisticated toolkits and AI-assisted development.

Key Takeaways

A Python server running python3 -m http.server 8080 with active directory listing, hosted at IP 185.163.204[.]7 in Budapest, was cataloged on April 30, 2026 during a routine internet scan
Lexfo identified three distinct campaigns using two different techniques: AiTM proxy Evilginx (operators codemado and mail-argenta) and abuse of Microsoft OAuth device code flow (operator saroula01)
The saroula01 campaign captured 218 distinct accounts across 12 countries, approximately 94% corporate mailboxes, with 97 live Microsoft tokens kept active via automatic refresh
Signs of AI-assisted development appear in all three operations: commits co-authored by Claude, instructions.txt file from AI session, credit to CyberNeurova

The Operational Error: Directory Listing on Production Server

The exposed server ran on a machine in Budapest with a Python instance serving content via port 8080 without any restrictions. The readable .bash_history file contained the exact startup command, confirming a deliberate configuration rather than an accidental single-file leak. Lexfo was able to exfiltrate the complete toolkit, pivot across linked repositories, and reconstruct the supply chain of three active operators.

The first, tracked as 'codemado', is an Egyptian actor present on hacking forums since 2018. He managed an AiTM platform on the domain picis[.]net with a bulk mailer dubbed 'MaDoO Blaster'. His campaign went live on April 20, 2026 and continued after the April 30 discovery, with four Evilginx variants cloned from GitHub repositories of two other operators.

The second, 'mail-argenta' (Nigerian), had created the 'red-queen' fork with modifications to evade Subresource Integrity and path-based detection. He was identified via his own credentials found in infostealer logs, with a password reused in his Kraken panel. The third, 'saroula01' (identity undetermined), had developed the 'black-queen' fork based on Microsoft's OAuth device code flow.

Two Techniques, Two Risk Profiles: AiTM Proxy vs Device Code Flow

The two attack families exposed by the server present fundamentally different mechanisms and require equally distinct defenses. The classic AiTM proxy Evilginx scheme intercepts interactive sessions: the victim visits an attacker-controlled site, enters credentials and completes MFA, while the proxy forwards requests to the real server and captures session and cookies. This technique is neutralized by phishing-resistant MFA such as FIDO2 passkeys, which cryptographically bind authentication to the correct origin.

The device code flow abused by saroula01 works instead through legitimate inducement. The victim receives a code to enter at microsoft.com/devicelogin, genuine Microsoft infrastructure, and completes authentication and MFA normally. The attacker obtains the token via polling on the OAuth endpoint, intercepting nothing. As Lexfo noted, "calling this 'MFA bypass' misses how it works: nothing gets bypassed."

The practical consequence is that passkeys and FIDO2 do not protect against this vector: the victim authenticates themselves on legitimate Microsoft servers while authorizing the attacker's session. Microsoft had documented this technique in February 2025 in campaigns attributed with medium confidence to Russia-aligned actors; Lexfo's analysis now confirms its adoption by common criminals.

Persistent Tokens and RMM Persistence: The Arsenal Behind the Campaigns

Quantitative data recovered from the server documents a structured, persistence-oriented operation. In the saroula01 campaign, Lexfo counted 218 distinct accounts across 12 countries in the period June 2025–July 2026, with approximately 94% corporate mailboxes. A token file committed and then deleted, recoverable from the repository's git history, contained 97 live Microsoft tokens with autoRefresh active: some had been refreshed up to 25 times, indicating an active access-maintenance mechanism.

Codemado's arsenal also included seven RMM (Remote Monitoring and Management) tools, including ScreenConnect and SimpleHelp, to maintain persistent access to compromised machines. The complete toolkit and presence of a dedicated bulk mailer indicate an operator with post-infiltration management capabilities, not a mere phishing page replicator.

"Directory listing on a working attack server is close to a full confession" — Lexfo report, via The Hacker News

AI in the Glue Code: Incomplete Professionalization

A recurring aspect across the three operations is the use of AI tools to accelerate development, with differentiated qualitative impact. Saroula01's commits were co-authored by Claude; mail-argenta left an instructions.txt file verbatim from an AI session; codemado included credits to CyberNeurova, a code-generation API service. Lexfo clarified, however, that modifications to the Evilginx core were minor: "it was less the framework itself [...] than the code built around it."

The paradox exposed by the case is that of a criminal enterprise employing sophisticated toolkits and AI assistants but committing rookie operational errors, such as exposing a production server with directory listing. According to Infosecurity Magazine, citing Lexfo, "the barrier to running a functional AiTM campaign has dropped close to zero, with components either free on GitHub or sold on Telegram for a few hundred dollars." This low barrier to entry translates into proliferation of operators with discontinuous technical skills.

What to Do Now

Verify that Azure AD Conditional Access blocks or restricts the OAuth device code flow for scenarios not required by the organization, since this vector renders passkeys and FIDO2 ineffective
Inspect authentication logs for sessions with device code flow from unauthorized locations or applications, given that the technique leaves auditable traces on genuine Microsoft infrastructure
Check for tokens with repeated refresh or unjustified long sessions, indicator of possible active maintenance by actors with access to refresh tokens
Evaluate segmentation of corporate RMM access, considering that identified operators use tools like ScreenConnect and SimpleHelp as a second persistence phase

Domains Offline and Uncertainty on Evolution

Both main identified domains — picis[.]net and romnor[.]ca — were offline at the time of publication. The domain picis[.]net had, however, continued provisioning new subdomains until May 2026, indicating sustained activity before the blackout. Lexfo believes an infrastructure rotation or autonomous operator withdrawal is likely, rather than a coordinated law enforcement takedown.

The link between codemado and The Quarry ecosystem, a phishing-as-a-service (PaaS) documented by SOCRadar in June 2026 with an estimated 200 operators, remains indirect: MaDoO Blaster was found promoted in The Quarry's Telegram channel, but Lexfo defines the link as a supplier relationship, not organizational membership. The three identified operators could be independent acquirers of public toolkits or part of a more structured network: the dossier does not determine this.

The server exposure and campaign reconstruction offer a rare holistic view of an ecosystem that otherwise remains fragmented. The combination of AiTM and device code flow techniques, AI use to accelerate development, the attacker's human error, and persistence via tokens and RMM outline a landscape where technical sophistication coexists with operational fragility — and where the discovery of a single misconfiguration can illuminate an entire criminal supply chain.

Information verified against cited sources and current as of publication.

Sources

Sources and references