# Evilginx Operations Exposed: Misconfigured Server Leaks M365 Phishing Kits

> A misconfigured Python server exposed three live Evilginx phishing operations targeting Microsoft 365, revealing the attacker's toolkit and session cookies.

- Published: 2026-07-13T11:18:10.000Z
- Severity: high
- Category: Threat Intel
- Tags: Evilginx, Microsoft 365, Phishing, AitM, MFA Bypass
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/07/misconfigured-server-reveals-three.html
- Canonical: https://runtimerebel.com/blog/evilginx-operations-exposed-misconfigured-server-leaks-m365-phishing-kits

## Key points

- Attackers are actively targeting Microsoft 365 accounts using Evilginx to bypass multi-factor authentication and steal session cookies.
- Impacted systems include any Microsoft 365 environment where users are susceptible to adversary-in-the-middle phishing attacks.
- Defenders must implement FIDO2-based authentication and monitor for suspicious session cookie usage to mitigate session hijacking risks.

Lexfo researchers recently uncovered three distinct phishing operations after an attacker inadvertently exposed their infrastructure. According to [The Hacker News](https://thehackernews.com/2026/07/misconfigured-server-reveals-three.html), the exposure occurred when an operator left a Python web server running with directory listing enabled on a public-facing port. The command `python3 -m http.server 8080` was discovered in the `.bash_history` file, allowing researchers to download the attacker's entire toolkit and analyze the active campaigns.

## The Mechanics of Adversary-in-the-Middle Attacks

The campaigns leveraged Evilginx, a well-known framework for conducting [Adversary-in-the-Middle (AiTM)](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) attacks. Unlike traditional [Phishing](/glossary#phishing) that merely clones a login page to steal credentials, AiTM frameworks proxy the actual login session between the victim and the legitimate service provider, such as Microsoft 365. This allows the [APT](/glossary#apt) or cybercriminal to bypass multi-factor authentication (MFA) by capturing the session token (cookie) after the victim successfully authenticates. 

To understand the scale of the threat, organizations must understand **how to detect Evilginx phishing campaigns** within their own network traffic. These attacks often utilize lookalike domains and transparent proxies that are difficult for standard security filters to identify at the perimeter. The Lexfo discovery highlights that even sophisticated actors can fall victim to basic operational security (OPSEC) failures, providing a rare window into their [TTP](/glossary#ttp).

## Technical Analysis of the Infrastructure Leak

The exposed server acted as a [C2](/glossary#c2) node for managing multiple "phishlets"—custom configuration files used by Evilginx to target specific services. By analyzing the leaked files, researchers could see how the attacker organized their infrastructure to target Microsoft 365 accounts globally. The leak included session logs, which contained captured cookies for victims who had already been compromised. This demonstrates that the attack was not theoretical but was actively harvesting access to corporate environments.

A significant portion of the technical analysis focused on **Microsoft 365 MFA bypass mitigation** strategies. Since the attacker was essentially stealing an active session, standard SMS or push-based MFA provided no protection once the session cookie was exfiltrated. The presence of the `.bash_history` file also revealed the sequence of commands used to set up the server, including the installation of dependencies and the manual modification of the Evilginx source code to avoid detection by automated scanners and [EDR](/glossary#edr) solutions monitoring for known signatures.

### Detection and Remediation: Strengthening the SOC

Security teams should prioritize **Adversary-in-the-Middle attack detection** by monitoring for unusual sign-in patterns. Because the stolen session cookies can be used from different geographic locations, "impossible travel" alerts in the [SIEM](/glossary#siem) are a critical [IoC](/glossary#ioc) for the [SOC](/glossary#soc) to track. 

To mitigate these risks, organizations should consider the following actions:

*   **Adopt Phishing-Resistant MFA**: Transition from legacy MFA methods to FIDO2-compliant hardware keys or Windows Hello for Business. These methods bind the authentication to the specific domain, preventing AiTM proxies from successfully intercepting the handshake because the domain in the proxy (e.g., `micros0ft-login.com`) will not match the domain on the security key's credential.
*   **Monitor Session Tokens**: Use cloud identity tools to flag session tokens that are used from IP addresses or browsers that do not match the initial login context. Any sudden change in user agent or IP reputation during an active session should trigger an automated revocation of that session.
*   **Conditional Access Policies**: Implement strict policies that require compliant, managed devices for access to sensitive Microsoft 365 resources. This reduces the risk of a successful [Privilege Escalation](/glossary#privilege-escalation) or [Lateral Movement](/glossary#lateral-movement) after an initial account compromise, as the attacker's proxy server is unlikely to meet the device compliance requirements.

This incident serves as a reminder that while offensive tools are becoming more automated and capable of bypassing legacy security, the human element—and simple configuration errors—remain a vulnerability for both the victim and the attacker. Regular audits of internet-facing infrastructure are essential to ensure that developers or administrators have not inadvertently exposed internal tools or history files that could provide a map for defenders or rival threat actors.

**Related:** [ARToken PhaaS Exposes EvilTokens' M365 Phishing Toolkit](/blog/artoken-phaas-exposes-eviltokens-m365-phishing-toolkit), [AitM Phishing Attacks Target US Organizations with Conduct Reports](/blog/aitm-phishing-attacks-target-us-organizations-with-conduct-reports)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/evilginx-operations-exposed-misconfigured-server-leaks-m365-phishing-kits