The Server That Talked Too Much
It started with a Python HTTP server on a Budapest VPS. Directory listing was switched on. That was the only mistake — but it was enough.
In late April, researchers at French security firm Lexfo stumbled onto an open directory that should never have been public. Inside: phishing configurations, stolen credential logs, remote management installers, and — most damaging of all — the operator’s own Telegram session files. Everything was readable. Everything was exposed.
The server belonged to a threat actor tracked as codemado, who was running an Evilginx-based adversary-in-the-middle (AiTM) platform aimed squarely at corporate Microsoft 365 accounts. But codemado wasn’t working alone. The open directory revealed a whole ecosystem.
Three Actors, One Code Lineage
Lexfo traced artifacts on the server back to an Egyptian operator active on hacking forums since 2018. Codemado’s toolkit went beyond the phishing proxy itself. The host held a seven-tool remote monitoring and management (RMM) arsenal — including ScreenConnect and SimpleHelp — plus a custom bulk-mailer of his own design called MaDoO Blaster.
But codemado was just the first thread. Two other operators surfaced through the Evilginx forks he had cloned from GitHub. Lexfo is careful to note that shared code doesn’t prove coordination — the repositories were public, after all. Still, the technical links are unmistakable.
An operator called mail-argenta was identified through infostealer logs containing his own reused credentials. The clincher: a MySQL password hardcoded into a phishing panel. Lexfo’s analysis points to a Nigerian individual behind this operation.
The third actor, saroula01, built something more sophisticated: a framework that abuses the OAuth Device Code Flow. This is a legitimate Microsoft feature where the victim completes authentication on a real Microsoft page, while the attacker’s backend quietly claims the token in the background. The victim thinks they’ve logged in normally. They have no idea their session was hijacked.
Device Code Campaign Ran Undetected for a Year
Of the three, saroula01’s operation was the largest by far. Lexfo reconstructed a deleted configuration file from git history. Internal bot timestamps dated the campaign to June 2025 — meaning it had been running for over a year without any apparent interruption.
During that window, it accumulated 218 confirmed victims across 12 countries. Roughly 94% of them were corporate targets. Captured tokens were set to refresh automatically in the background. Recovered entries had been silently refreshed up to 25 times, maintaining access long after the initial phish. The attackers didn’t need to steal passwords again. They already owned the session.
A thread running through all three operators is the use of generative AI to build the tooling. Lexfo found evidence of AI co-author metadata on saroula01’s commits, plus a saved development session in mail-argenta’s repository. This isn’t speculative — the metadata is right there in the code history.
MaDoO Blaster and The Quarry Connection
Lexfo also connected codemado’s MaDoO Blaster to The Quarry, a phishing-as-a-service (PaaS) ecosystem documented by SOCRadar in June. The Quarry is run by an actor known as RockyBelling, who promoted the tool to his customers. This isn’t a lone wolf scenario. These operators are plugged into a broader underground economy.
The takeaway from Lexfo’s research is sobering: the barrier to running a functional AiTM campaign has dropped close to zero. Components are either free on GitHub or sold on Telegram for a few hundred dollars. You don’t need to be a skilled developer anymore. You just need to copy-paste and pay.
What Defenders Need to Know
Lexfo urges defenders to assume any actor can bypass MFA through session hijacking or Device Code Flow abuse. The old advice — “enable MFA and you’re safe” — no longer holds. Attackers aren’t breaking MFA; they’re sidestepping it entirely.
If your organization doesn’t need device code authentication, disable it. Monitor for unexpected token refresh activity. Treat session tokens as sensitive as passwords — because they are.
For a deeper look at how these attacks work, see our coverage of AiTM phishing targeting TikTok for Business and the broader shift in phishing-as-a-service tactics. The threat landscape has changed. The open directory in Budapest was a warning. Whether anyone listens is the real question.
