The Slip That Unraveled a Phishing Empire
It started with a simple oversight. A Python web server, left listening on a public port with directory listing enabled. The command python3 -m http.server 8080 was still sitting in the readable .bash_history.
That one mistake gave French security firm Lexfo a window into a live Microsoft 365 phishing operation. And from that single lapse, they didn’t just lift the operator’s entire toolkit. They pivoted through it to uncover two more.
How a .bash_history File Blew the Cover
Attackers running Evilginx — a popular reverse-proxy phishing framework — usually cover their tracks. They hide servers behind VPNs, rotate domains, and scrub logs. But this operator got sloppy.
The exposed server was running on port 8080, completely open. Directory listing was on. That meant anyone could browse the file system. Lexfo found the .bash_history file, which contained not just the server command but also paths to phishing kits, configuration files, and session data.
From there, they extracted the full toolkit: custom templates mimicking Microsoft 365 login pages, redirect scripts, and harvested credential logs. The operator had been running campaigns targeting enterprise users across multiple industries.
The First Phishing Ring: Live and Active
The first operation was still active when Lexfo found it. It used Evilginx to intercept login credentials and session cookies from Microsoft 365 users. Victims landed on a near-perfect replica of the Microsoft login page. Once they entered their details, the attacker grabbed everything — username, password, and the session token — then redirected them to the real Microsoft site.
This gave the attacker persistent access. Even if the victim changed their password later, the session cookie remained valid until it expired. That’s the core danger of Evilginx: it bypasses multi-factor authentication by stealing the session itself.
Pivoting to Two More Operations
Lexfo didn’t stop at the first server. Using credentials and infrastructure details found in the exposed files, they traced connections to two more Evilginx phishing operations. These were separate rings, likely run by different operators, but they shared some infrastructure — possibly a common hosting provider or a resold server.
The second ring targeted Microsoft 365 users in the financial sector. The third went after healthcare organizations. Both used similar Evilginx templates, suggesting either a shared source code repository or a commercial relationship between the attackers.
Lexfo declined to name the hosting provider publicly but said they reported all findings to relevant authorities and Microsoft’s security team.
Why Evilginx Is So Dangerous for Microsoft 365
Evilginx is not your average phishing kit. It’s a reverse proxy that sits between the victim and the real login page. The victim interacts with the real Microsoft 365 interface — they see the real branding, the real URL (with a slight twist), and even real MFA prompts. The attacker just copies everything in transit.
This makes it incredibly hard to detect. Traditional security training tells users to check the URL. But Evilginx uses domains that look legitimate, like login-microsoft.com or microsoft-365.secure-login.net. Even savvy users can fall for it.
Microsoft 365 is the prime target because it’s the backbone of corporate communication and data. One compromised account can lead to email theft, data exfiltration, and lateral movement inside a company network.
Lessons from the Misconfiguration
This case is a reminder that attackers are only as strong as their operational security. A single open port, a forgotten history file, and the whole house of cards falls.
For defenders, it’s a lesson in proactive monitoring. Lexfo found the server by scanning for exposed services. That’s something any security team can do — regularly check for unintended public exposure, especially on non-standard ports.
For organizations using Microsoft 365, the takeaway is clear: session-based attacks bypass MFA. You need additional layers — like conditional access policies, device compliance checks, and user behavior analytics — to catch anomalies even after login.
The three rings are likely still active, just on different servers now. But the exposure of their tools and methods gives defenders a rare advantage: they know exactly what to look for.
Lexfo has published a detailed technical report with indicators of compromise. Security teams should grab it and check their logs. The attackers made one mistake. It’s up to the good guys to make sure it counts.
