Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

Summary: A misconfigured Python web server with directory listing enabled exposed a live Microsoft 365 phishing operation, and French firm Lexfo used the leaked toolkit and .bash_history to trace two more operators running custom Evilginx forks. The largest campaign ran for more than a year, and one fork logged 218 captured accounts across a dozen countries between June 2025 and July 2026, about 94 percent of them corporate mailboxes. The three operations defeated MFA two ways: proxying the live login, and abusing Microsoft's OAuth device code flow, where the victim completes a real MFA prompt on genuine Microsoft infrastructure.
Why it matters: A shop hardened against reverse-proxy phishing with FIDO2 or passkeys is still open to device-code abuse, because the victim clears a real MFA prompt on Microsoft's own page; closing that path is a Conditional Access policy that exists only once someone writes it. The operators built none of their frameworks, cloning them from public GitHub, and Lexfo assesses the barrier to a working campaign has fallen to near zero.

Read the original at The Hacker News ↗