On 2026-07-13, Lexfo's CTI team published findings from an internet-exposed Python HTTP server that had directory listing enabled, fully revealing the operational toolkit of a Microsoft 365-focused adversary-in-the-middle (AiTM) phishing ecosystem. The server, running at 185.163.204.7 (AS56322, ServerAstra, Budapest) and provisioned on 2026-03-13, hosted three customized Evilginx2 forks running simultaneously: 'saroula01/black-queen' (primary), 'mail-argenta/red-queen' (secondary), and additional clones used for A/B testing of phishing lures. The exposure ties together three overlapping but operationally distinct AiTM campaigns.

The primary operator, using the handle 'codemado' (aka MaDoO), is assessed as an Egyptian threat actor active since 2018, identified via GitHub repositories, Telegram sessions (@mad0o0o0o0o), and hardcoded credentials tied to the email codemadooo@gmail.com. Codemado's phishing infrastructure is centered on the domain picis[.]net with 30+ subdomains, including owa.picis[.]net (Outlook Web Access proxy), sso.picis[.]net (targeting National Australia Bank SSO), verify.picis[.]net (a custom Node.js anti-bot fingerprinting gateway using FingerprintJS2), and vinicious.picis[.]net (a ScreenConnect RMM console). Six social-engineering lure paths impersonate Microsoft Office, OneDrive, Microsoft Authenticator MFA prompts, Adobe PDF, DocuSign, and SharePoint. The toolkit harvests Primary Refresh Tokens (PRT) and ESTSAUTH session cookies with a 31,536,000-second (12-month) TTL that survives password resets, enabling long-term persistent M365 account access.

Codemado's custom bulk-mailer, MaDoO Blaster v4.7.3, supports multi-account SMTP rotation with per-account sending limits, a 'B2B mode' that abuses Microsoft Entra Client IDs to inject mail directly via the Microsoft Graph API, HTML template personalization (victim domain, company name, randomized strings), dynamic payload generation across PDF/DOCX/PPTX/ZIP/EML formats, a 'letter-to-image' conversion feature for spam-filter evasion, AI-generated voicemail (.wav) lures, QR-code-based per-recipient tracking, sender/From-address rotation, and an optional saveToSentItems flag to hide outbound phishing mail from the compromised mailbox. Codemado also deployed a seven-tool remote monitoring and management (RMM) arsenal for post-compromise access: a trojanized ScreenConnect installer distributed via the Telegram channel @hackers_assemble, SimpleHelp, SuperOps RMM (installed silently via /qn LicenseAccepted=YES), GetScreen.me (delivered by a VBScript stager), XEOX RMM (a VBScript dropper hosted on GitHub at codemado/api), ITarian Endpoint Manager v10.3.51334.25120, and a secondary AsyncRAT botnet (MaDOOOOOOOO_Work) with C2 at 83.136.211[.]85:7077 (a prior botnet C2 was observed at 188.227.196[.]240:7077). Payload delivery used multiple obfuscation layers: a 4.5MB obfuscated PowerShell script (dddd.ps1), a JScript dropper (Statement.js) using ActiveXObject, a three-layer VBScript-to-Base64-to-AES-encrypted delivery chain, trojanized MSI installers (AdobeClientSetupV16.msi, NEWPANEL.msi), and PowerShell disguised with a .jpg extension (dddd.jpg). Dedicated credential-stealer binaries pass.exe and getpass.exe were also recovered. Codemado credited the 'CyberNeurova' uncensored AI platform inline in code comments as an aid in malware development. A credential validation pipeline was also exposed: a Telethon script monitoring 100+ Telegram channels for combolists, a 100-thread SMTP credential checker (587_checker.py) validating against port 587, with confirmed-working accounts logged to Valid.log, and a QR-code redirect tracker (redir/app.js) that reports victim IP, country, and device type prior to serving the phishing page. Prior codemado activity was observed in January 2026 against queeenspropertyservices[.]ca.

The second operator, 'mail-argenta', is assessed as Nigerian and maintains 23 public GitHub repositories including multi-platform phishlets. Their Evilginx2 fork, 'red-queen', includes a Subresource Integrity (SRI) bypass that renames the crossorigin/integrity HTML attributes to rickorigin/tegridy to defeat browser SRI checks, a custom URL-rewriting engine in http_proxy.go, pre-filled victim-email injection to reduce user friction, and a pre-compiled evilginx2.exe binary. Mail-argenta's campaigns target Microsoft 365, the Kraken cryptocurrency exchange (via a Puppeteer-based MitM panel dubbed 'kraken-live-panel'), LinkedIn, eHarmony, GitHub, and Bybit. Operator attribution was made via credentials recovered from infostealer logs that matched the GitHub commit email and repository .env files; a reused MySQL password (Passionate1947.) was found hardcoded across the operator's personal accounts. Captured M365 sessions (ESTSAUTHPERSISTENT cookie) were valid through 2027-06-30.

The third operator, 'saroula01', remains unattributed but operates from Canadian-hosted Azure infrastructure at 20.118.27.127, using the domain romnor[.]ca. Rather than classic AiTM credential relay, saroula01's campaign abuses the OAuth Device Code Flow — a technique that bypasses MFA entirely by tricking victims into authorizing a device code on a legitimate Microsoft login page while the attacker polls for the resulting token. Six lure subdomains impersonate M365, OneDrive, Microsoft Authenticator, Adobe, DocuSign, and SharePoint (briefing/share/account/download/sign/team.romnor[.]ca/go). The campaign abused Microsoft's own first-party Office OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) to make device-code prompts appear legitimate, has been active since 2025-06-18, and had accumulated 218 confirmed victims across 12 countries at time of discovery (94% corporate). 97 harvested tokens had autoRefresh enabled and had been refreshed up to 25 times, providing durable persistent M365 access without any credential re-entry.

Lexfo also identified an ecosystem link: MaDoO Blaster is promoted by 'RockyBelling', operator of 'The Quarry' malware/phishing-as-a-service (MaaS/PhaaS) offering, inside the 'Rocky War Room' Telegram channel — indicating codemado functions as a third-party tool vendor to The Quarry's affiliate base rather than as a direct affiliate. A Cloudflare Tunnel (ID 1655dd1a-1c05-4818-8491-332f29713dca) was also identified as part of the exposed infrastructure, likely used to mask origin hosting for one or more of the phishing panels.

Collectively, the exposure demonstrates the fragility of operational security among AiTM phishing-as-a-service operators, the increasing sophistication of session-cookie and refresh-token theft techniques designed to defeat MFA, the growing convergence of AiTM phishing kits with commercial RMM tooling for post-compromise access, and abuse of legitimate cloud identity flows (OAuth Device Code Flow, Microsoft Graph API mail injection) to blend malicious activity into normal enterprise traffic.