How One Lapse Exposed Three Evilginx Phishing Operations

Michael Miller · 2026-07-13

You know that feeling when you leave your front door unlocked by accident? That's basically what happened here, except the "house" was a live Microsoft 365 phishing operation, and the "unlocked door" was a Python web server left exposed on a public port. An attacker running this whole show made a simple mistake: they left a Python web server listening on a public port with directory listing switched on. The command that did it—`python3 -m http.server 8080`—was still sitting in the readable `.bash_history`. That one oversight gave French security firm Lexfo everything they needed. ### The Lapse That Changed Everything From that single misconfiguration, Lexfo lifted the operator's entire toolkit. And here's where it gets interesting: they didn't just stop there. They pivoted through that initial access to uncover two more separate Evilginx operations, all targeting Microsoft 365 users. Think about that for a second. One exposed port, one readable history file, and suddenly three different phishing campaigns are laid bare. It's a powerful reminder that in cybersecurity, the smallest crack can bring down the whole wall. ### What Are Evilginx Attacks Anyway? If you're not familiar, Evilginx is a type of man-in-the-middle attack framework. It sits between a user and a legitimate website—like Microsoft 365—and captures everything: login credentials, session cookies, even multi-factor authentication tokens. It's scary stuff because it bypasses a lot of standard protections. What makes this particular case so alarming is the scale. Three separate operations, all running simultaneously, all targeting the same platform. That tells you this isn't some lone wolf in a basement. This is organized, professional-grade phishing. ### How the Discovery Unfolded Lexfo's approach was methodical. They: - Found the exposed server and accessed the directory listing - Read the `.bash_history` file to understand the attacker's workflow - Extracted the full toolkit, including configuration files and scripts - Used that information to identify two related operations It's like finding one set of footprints in the sand, then realizing they lead to an entire camp. The security firm didn't just close one door; they exposed a whole network. ### What This Means for You If you're running a business that relies on Microsoft 365—and let's be honest, who isn't these days—this should make you sit up and pay attention. These attacks aren't just theoretical. They're happening right now, and they're getting more sophisticated by the day. The takeaway? Never underestimate the power of a simple misconfiguration. That server was supposed to be internal, but someone forgot to lock it down. And that's all it took for the whole operation to unravel. ### Protecting Yourself Against Similar Threats So what can you do? A few practical steps: - **Audit your exposed services regularly.** Anything listening on a public port should have a reason to be there. - **Use multi-factor authentication**, but understand it's not a silver bullet. Evilginx can bypass it. - **Monitor for unusual login patterns.** If someone logs in from an IP you don't recognize, investigate. - **Train your team.** Phishing awareness isn't just about spotting fake emails anymore. It's about understanding how sophisticated these attacks can be. ### The Bigger Picture This incident is a textbook example of why defense in depth matters. The attacker made one mistake, and it cost them everything. But it also shows how determined these operators are. They're running multiple campaigns simultaneously, targeting one of the most widely used business platforms in the world. For security professionals, this is both a warning and an opportunity. A warning that the threat landscape is evolving faster than ever. And an opportunity to learn from someone else's mistake without having to make it yourself. At the end of the day, cybersecurity isn't about being perfect. It's about being one step ahead. And sometimes, that step is as simple as checking which ports are open. Stay sharp out there. The bad guys aren't taking a day off.