Misconfigured Server Exposes Three Evilginx Operations Targeting…

A phishing server with directory listing enabled exposed complete M365 phishing toolkits, two distinct MFA bypass techniques, and evidence of AI-assisted development. Discovered by Lexfo in late April 2026, the server revealed three independent Evilginx operations, including one abusing Microsoft's legitimate OAuth device code flow—a method that defeats FIDO2 and passkeys.

A phishing server with directory listing enabled exposed three distinct Evilginx operations against Microsoft 365, revealing complete toolkits, criminal operator identities, and two mechanically different techniques for bypassing multi-factor authentication. The discovery, made by Lexfo in late April 2026, documents how mid-tier operations now use artificial intelligence to accelerate the development of custom phishing infrastructure.

Key Takeaways

A server running python3 -m http.server 8080 with directory listing enabled exposed a readable .bash_history, revealing three independent Evilginx operations
Two distinct compromise techniques: live AiTM proxy and abuse of Microsoft's legitimate OAuth device code flow, the latter not blockable by FIDO2 or passkeys
Operator saroula01 captured 218 distinct accounts in Telegram bot logs between June 2025 and July 2026, with approximately 94% corporate mailboxes
Signs of AI-assisted development across all three operations: commits co-authored by Claude, an instructions.txt file from an AI session, credit to CyberNeurova API

How a Directory Listing Unmasked an Entire Ecosystem

The server, at IP address 185.163.204[.]7 in Budapest, was cataloged during a routine internet scan conducted by Lexfo in late April 2026. The faulty configuration—a Python HTTP server on port 8080 with directory listing enabled—made the .bash_history file readable, tracing commands, repository clones, and deployment operations.

Lexfo identified three distinct operators, all using custom forks of Evilginx cloned from public GitHub. The first, 'codemado,' is an Egyptian actor active since 2018, with an AiTM platform on picis[.]net and bulk mailer 'MaDoO Blaster'; their campaign began April 20, 2026. The second, 'mail-argenta,' operates from Nigeria: their 'red-queen' fork modifies HTML attributes to bypass Subresource Integrity and integrates a URL-rewriting engine in the http_proxy.go file. The third, 'saroula01,' an unde-anonymized handle, manages the 'black-queen' fork and abuses Microsoft's OAuth device code flow without any intermediate proxying.

"Directory listing on a working attack server is close to a full confession"

AiTM and Device Code: Two Techniques, One Target

The first two operations converge on the same mechanism: the AiTM (Adversary-in-The-Middle) proxy. Evilginx intercepts credentials and sessions in real time, allowing the attacker to bypass traditional MFA. This technique is vulnerable to origin-bound authentication: FIDO2 and passkeys neutralize it, since they bind the cryptographic signature to the original domain.

The third technique, used by saroula01, is mechanically different. The operator abuses Microsoft's legitimate OAuth device code flow: the victim authenticates at microsoft.com/devicelogin, a genuine endpoint, entering a code provided by the attacker. The generated token is valid and transferable. No proxy is needed; no spoofed domain is visited. The result is that FIDO2 and passkeys offer no protection, because the victim authenticates themselves on legitimate Microsoft infrastructure, authorizing the attacker's session.

According to Lexfo's CTI team: "Calling this 'MFA bypass' misses how it works: nothing gets bypassed." The distinction is not rhetorical: it radically changes the defensive perimeter required. Microsoft documented this technique in February 2025 in the Storm-2372 campaign, associated with medium confidence to Russia-aligned operators.

The Numbers Behind the saroula01 Operation

Telegram bot logs from saroula01 document 218 distinct accounts captured between June 2025 and July 2026. Approximately 94% are corporate mailboxes. A file in the repository's git history contains 97 live Microsoft tokens with autoRefresh enabled; some tokens show up to 25 refreshes, indicating prolonged persistence in access to compromised services.

Mail-argenta was identified through their own credentials found in infostealer logs, with a password reused on the Kraken panel—an operational error that enabled de-anonymization. For codemado and saroula01, real identities were not fully de-anonymized in the report.

Artificial Intelligence as a Glue Code Accelerator

All three operations show convergent signs of AI-assisted development. In saroula01's fork, commits co-authored by Claude. In mail-argenta's repository, an instructions.txt file traces an AI session with prompts and responses. In codemado's toolkit, explicit credit to CyberNeurova API.

Lexfo's CTI team assessment is calibrated: "The Evilginx forks carried only minor changes to the core, and that the clearer signs of AI use sat in the glue code around them." Artificial intelligence did not generate the phishing framework—Evilginx remains established open-source software—but lowered the barrier to entry for customizing phishlets, automation scripts, and supporting components. This aligns with the dossier's framing: the democratization of AI enables mid-level criminal operations without advanced technical skills.

Defensive Measures

Defensive measures depend on the adversary technique:

For AiTM proxy: implement origin-bound authentication via FIDO2 or passkeys, which neutralize interception by binding the session to the legitimate domain
For device code flow: block the flow where possible through Conditional Access policies, and enable Continuous Access Evaluation for rapid revocation of suspicious tokens
Monitor device code flow usage in enterprise environments: the absence of proxying makes it technically stealthier, but the authentication pattern is traceable in Azure AD logs
Assess visibility into public repositories and infrastructure-as-code: Lexfo's discovery came from internet scanning, not confidential intelligence

Three Operations, One Borderless Ecosystem

The three operators have indirect links to 'The Quarry' ecosystem, documented by SOCRadar in June 2026 with an estimated 200 operators. The relationship is one of supply, not membership: MaDoO Blaster was promoted in Telegram channels associated with The Quarry, but no evidence of direct membership emerges. The domains of all three operations were already offline before any Lexfo action; the CTI team interprets this as infrastructure rotation or voluntary withdrawal, not coordinated takedown.

The server exposure does not clarify whether the error was human or automated, nor how many total accounts were compromised by codemado and mail-argenta campaigns. The count of 218 accounts pertains exclusively to saroula01. The exact extent of AI contribution versus human development in each operation also remains unquantified.

The misconfiguration as a "double-edged sword" for the attacker: an elementary operational error turned a single server into a window onto an M365 phishing ecosystem that exploits legitimate infrastructure, strong authentication, and generative AI. Traditional defenses—MFA, FIDO2, awareness—remain necessary but insufficient against device code flow, which does not bypass authentication but suborns it through itself.

Frequently Asked Questions

Why don't FIDO2 and passkeys protect against device code flow?

Because the victim authenticates themselves on microsoft.com/devicelogin, a genuine Microsoft endpoint. FIDO2 and passkeys verify the domain, not the intent: if the domain is legitimate, the cryptographic signature is correctly issued, authorizing the attacker's session.

Is device code flow a Microsoft vulnerability?

No. It is a legitimate, documented, and supported OAuth flow, abused socially through psychological engineering. The distinction is relevant for the defensive perimeter: there is no patch to apply, but policies to configure.

Did AI "create" the phishing toolkits?

No. Changes to the Evilginx core are minor according to Lexfo. Signs of AI-assisted development are concentrated in the "glue code"—scripts, phishlets, automations—that customize and deploy the existing framework.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references