Source: The Hacker News
Author: info@thehackernews.com (The Hacker News)
URL: https://thehackernews.com/2026/07/misconfigured-server-reveals-three.html
ONE SENTENCE SUMMARY:
Lexfo exposed three Microsoft 365 phishing campaigns leveraging Evilginx and device-code OAuth abuse, highlighting distinct defenses: phishing-resistant MFA and Conditional Access.
MAIN POINTS:
- Exposed directory listing on a Python web server revealed complete phishing operation artifacts.
- .bash_history showed
python3 -m http.server 8080, enabling rapid operator attribution and tooling theft. - Lexfo pivoted from one server to identify two additional operators and campaigns.
- All three campaigns used custom forks of the open-source Evilginx proxy from GitHub.
- Two MFA-defeating methods emerged: reverse-proxy AiTM and OAuth device code phishing.
- codemado, an Egyptian forum actor, monetized access via MaDoO Blaster bulk mailer.
- red-queen fork added SRI evasion, URL rewriting, email prefilling, and long cookie TTLs.
- mail-argenta was exposed via infostealer logs showing credential reuse and hardcoded MySQL password.
- black-queen used legitimate microsoft.com/devicelogin, capturing tokens without collecting passwords.
- Researchers found AI-assisted development evidence mainly in scripts, phishlets, and “glue” code.
TAKEAWAYS:
- Disable directory listings and protect shell histories to avoid turnkey compromise of attacker infrastructure.
- Deploy FIDO2/passkeys to stop Evilginx-style reverse-proxy phishing via origin binding.
- Block OAuth device code flow by default using Conditional Access, permitting only necessary devices.
- Enable CAE and IP/location-based Conditional Access to reduce stolen-token lifetime and usefulness.
- Monitor Entra logs for suspicious refresh-token grants and “Original transfer method” device-code indicators.