Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

A misconfigured server exposed three active Evilginx phishing operations targeting Microsoft 365 users, enabling attackers to bypass MFA through proxy-based login interception and abuse of Microsoft's legitimate device code flow. The operations, attributed to threat actors codemado, mail-argenta, and saroula01, leveraged custom forks of open-source Evilginx hosted on public GitHub repositories. One campaign used AI-assisted development, and all three harvested corporate credentials, with sessions maintained via long-lived cookies and token refresh mechanisms. The incident highlights the growing accessibility of phishing-as-a-service and the need for robust Conditional Access policies.

AI-extracted · verify before operational use