Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

1. Executive summary

A misconfigured Python web server (python3 -m http.server 8080) with directory listing enabled exposed the full toolkit, logs, and bash history of a Microsoft 365 adversary-in-the-middle (AiTM) phishing operator tracked as "codemado." French security firm Lexfo leveraged the exposure to pivot to two additional operators ("mail-argenta" and "saroula01"), revealing three distinct campaigns — two using Evilginx AiTM proxies and one abusing Microsoft's OAuth device code flow. The largest campaign ran for over a year; another captured session cookies with a one-year TTL (31,536,000 seconds) capable of outlasting password resets. EMEA financial services running Microsoft 365 without Continuous Access Evaluation (CAE)-capable Conditional Access policies are directly in scope. No verified CVE reference data was resolved for this item; no CISA-KEV exploitation state applies.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Operator infrastructure exposure — The primary operator ("codemado") left a Python HTTP server running on port 8080 with directory listing enabled on a host at 185.163.204[.]7 (Budapest). The command python3 -m http.server 8080 was recoverable from .bash_history. The directory listing exposed phishing configs, credential-harvesting logs, RMM installers, combolists, backup archives, and Telegram session files.
2. AiTM proxy deployment — An Evilginx adversary-in-the-middle proxy ran on the same host alongside a SimpleHelp remote console. The Evilginx fork was cloned from public GitHub repositories. The server held four Evilginx variants from two other GitHub developers, both of whom were active operators.
3. Campaign execution (codemado) — The campaign went live on April 20, 2026, and was still running past April 30, 2026, when the directory was discovered. Fresh subdomains and a renewed wildcard certificate appeared weeks later. The operator's bot logged captures against two corporate M365 accounts (one French, one North American). Repeated captures of the same accounts from different IPs are consistent with the operator refreshing stolen tokens as they aged out. The platform runs on picis[.]net; monetisation is via a bulk mailer called "MaDoO Blaster."
4. MFA bypass method 1 — AiTM session cookie theft (mail-argenta fork, "red-queen") — The Nigerian operator "mail-argenta" fork modifies Evilginx to: - Rename crossorigin and integrity HTML attributes to defeat Subresource Integrity (SRI) checks. - Add a URL-rewriting engine to http_proxy.go to evade path-based detection. - Pre-fill the victim's email address to reduce abandonment. - Set a 1-year TTL (31,536,000 seconds) on captured Microsoft session cookies, allowing intercepted logins to outlast password resets. Without a CAE-capable Conditional Access policy, stolen cookies remain usable for months. - A pre-compiled evilginx2.exe is committed to the repo, eliminating the build step for buyers. - One captured M365 cookie found in the repo carried an expiration date of June 30, 2027.
5. MFA bypass method 2 — OAuth device code flow abuse (saroula01 fork, "black-queen") — The operator "saroula01" (identity unconfirmed beyond handle) built a fork that does not touch passwords. It abuses Microsoft's OAuth device code flow — a legitimate sign-in path for input-constrained devices. The attack generates a real device code, wraps it in an Authenticator-themed lure page, and instructs the target to enter the code at the genuine microsoft.com/devicelogin. The victim signs in on a real Microsoft page and clears MFA themselves. This fork logged the highest number of captures of the three.

Operator attribution

• codemado — Egyptian actor active in VoIP and hacking forums since 2018. Runs an M365 AiTM platform on picis[.]net; monetises via "MaDoO Blaster" bulk mailer. Attribution is single-sourced (Lexfo report only); no MITRE ATT&CK profile was resolved in the verified reference data. Treat as unconfirmed.
• mail-argenta — Nigerian operator. Identified after his email and password were found in infostealer logs; the leaked password matched the MySQL password hardcoded in his Kraken panel and was reused across his accounts. Attribution is single-sourced (Lexfo); no MITRE profile resolved. Treat as unconfirmed.
• saroula01 — Researchers could not identify beyond the handle. Attribution unconfirmed.

Confidence caveat: All technical detail, attribution, and IOC material in this advisory derives from a single source (Lexfo via The Hacker News). No independent corroboration was available at time of writing. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Block known infrastructure: Add 185.163.204[.]7 and picis[.]net to firewall, proxy, and DNS sinkhole blocklists. Note: the IP may be decommissioned or rotated; treat as historical.
• Hunt for AiTM session-cookie compromise: Query Microsoft 365 audit logs for suspicious sign-in patterns — repeated authentications from rotating IPs against the same account, sign-ins from Budapest/Hungarian IP ranges, and tokens issued outside expected geographic or device baselines.
• Hunt for device-code-flow abuse: Search Entra ID (Azure AD) sign-in logs for microsoft.com/devicelogin authentications that completed MFA but originated from unexpected locations or devices. Filter for DeviceCode authentication method in sign-in logs.
• Review Conditional Access policies: Confirm whether CAE (Continuous Access Evaluation) is enabled. Without CAE, stolen session tokens remain valid until their natural expiration — up to 1 year in the red-queen fork's configuration. Enable CAE-capable policies on all M365 tenants immediately.
• Revoke active sessions: For any accounts showing suspicious token-refresh patterns, force a full session revocation in Entra ID ("Revoke sign-in sessions"). Note: password reset alone is insufficient — the 1-year cookie TTL is designed to survive it.

P2 — Within 72 hours

• Deploy Evilginx detection signatures: Inspect inbound email and web proxy logs for Evilginx proxy indicators — cloned Microsoft login pages served from non-Microsoft domains, especially those with modified crossorigin/integrity attributes or unusual http_proxy.go URL-rewriting behaviour.
• Restrict device code flow: If device code flow is not required by the business, disable it in Entra ID via Conditional Access or PowerShell. If required, restrict to specific groups or require compliant devices only.
• Audit SimpleHelp exposure: The operator co-located a SimpleHelp remote console on the phishing host. If SimpleHelp is used legitimately in the environment, audit for unauthorised instances and ensure all deployments are patched and access-controlled.
• Monitor for token-refresh anomalies: Configure Microsoft Defender for Cloud Apps or equivalent CASB to alert on session tokens being refreshed from new IP addresses or geographies inconsistent with the user's baseline.

P3 — Within 7 days

• Implement FIDO2 / phishing-resistant MFA: AiTM proxies and device-code-flow attacks cannot defeat hardware security keys (FIDO2/WebAuthn). Prioritise migration of all privileged and high-risk accounts to FIDO2 authentication.
• Session token lifetime reduction: Where CAE is not yet deployed, reduce session token lifetimes in Entra ID to minimise the window of abuse for stolen cookies. Default configurable token lifetimes should be reviewed against the 31,536,000-second (1-year) TTL observed in the wild.
• Threat-hunt for evilginx2.exe: Search endpoint telemetry for the pre-compiled binary name evilginx2.exe on all Windows endpoints and servers. Its presence is a high-confidence indicator of an operator or test environment.
• Review SRI monitoring: The red-queen fork's renaming of crossorigin and integrity attributes is designed to defeat Subresource Integrity checks. Ensure web proxy and DLP tools alert on Microsoft login pages where these attributes are absent or renamed.

5. Indicators of compromise

ipv4  185.163.204.7
domain  picis.net
url  microsoft.com/devicelogin
filename  evilginx2.exe
filename  http_proxy.go
actor  codemado
actor  mail-argenta
actor  saroula01
tool  MaDoO Blaster

6. Detection

rule Evilginx_Red_Queen_Fork_Indicators {
    meta:
        author = "Adverse Trace"
        date = "2026-07-13"
        reference = "https://thehackernews.com/2026/07/misconfigured-server-reveals-three.html"
        description = "Detects indicators associated with the red-queen Evilginx fork by mail-argenta: modified HTML attributes, URL-rewriting in http_proxy.go, pre-compiled binary, and 1-year cookie TTL"
    strings:
        $binary_name = "evilginx2.exe" ascii nocase
        $proxy_file = "http_proxy.go" ascii nocase
        $ttl_value = "31536000" ascii
        $attr_crossorigin = "crossorigin" ascii
        $attr_integrity = "integrity" ascii
        $cookie_exp_2027 = "2027-06-30" ascii
    condition:
        3 of them
}

title: Microsoft 365 OAuth Device Code Flow Phishing — Suspicious DeviceCode Authentication
id: AT-2026-07-13-281-devicecode
status: experimental
description: >
    Detects Microsoft 365 sign-ins via device code flow that completed MFA from
    unexpected locations or devices, consistent with the black-queen Evilginx fork
    (saroula01) that abuses microsoft.com/devicelogin with an Authenticator-themed lure.
references:

    - https://thehackernews.com/2026/07/misconfigured-server-reveals-three.html
author: Adverse Trace
date: 2026/07/13
logsource:
    product: microsoft
    service: azure_signinlogs
detection:
    selection_auth_method:
        authenticationMethod: "DeviceCode"
    filter_expected:
        location|contains:

            - "Expected Location 1"
            - "Expected Location 2"
    condition: selection_auth_method and not filter_expected
falsepositives:

    - Legitimate device code flow usage from input-constrained devices (printers, IoT, CLI tools)
    - Expected administrative device code authentications
level: high

title: Evilginx AiTM Session Token Refresh from Rotating IPs
id: AT-2026-07-13-281-token-refresh
status: experimental
description: >
    Detects repeated session token refreshes for the same M365 account from
    different IP addresses, consistent with codemado's observed behaviour of
    refreshing stolen tokens as they age out.
references:

    - https://thehackernews.com/2026/07/misconfigured-server-reveals-three.html
author: Adverse Trace
date: 2026/07/13
logsource:
    product: microsoft
    service: azure_signinlogs
detection:
    selection:
        resultType: 0
        tokenRefresh: true
    timeframe: 24h
    condition: selection | count(ipAddress) by userPrincipalName > 3
falsepositives:

    - Legitimate users on mobile networks with changing IPs
    - VPN users with rotating exit nodes
level: medium

7. Sources

• The Hacker News, "Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365," https://thehackernews.com/2026/07/misconfigured-server-reveals-three.html, 2026-07-13

8. Adverse Trace position

This is a high-severity threat for EMEA financial services. The combination of MFA bypass (two mechanically different methods), 1-year session-cookie TTLs that survive password resets, and confirmed targeting of corporate M365 mailboxes — including a French corporate account — places this directly in the threat surface of our client base. The single-source nature of the reporting (Lexfo via The Hacker News) means all IOCs and attribution should be treated as unconfirmed until independently corroborated; we recommend verifying the IP 185.163.204[.]7 and domain picis[.]net against current threat intelligence feeds before enforcement. The most urgent defensive gap is the absence of CAE-capable Conditional Access policies — without CAE, no amount of password rotation or MFA re-enrolment will invalidate stolen session tokens. We will monitor for independent corroboration, additional IOCs, and any indication of compromise within client environments. Clients should prioritise P1 actions immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.