Misconfigured Server Exposes Three Evilginx-Based Microsoft 365 Phishing Operations (codemado, mail-argenta, saroula01)
Misconfigured Server Exposes Three Evilginx-Based Microsoft (TL-2026-1258), also tracked as The Quarry-adjacent AiTM cluster, is a high-severity phishing campaign, first published 2026-07-13. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID (OAuth 2.0 Device Authorization, maps to 28 MITRE ATT&CK techniques (T1036, T1053.005, T1078.004), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1258
- Threat ID
- TL-2026-1258
- Also known as
- The Quarry-adjacent AiTM cluster, black-queen, red-queen
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-13
- Last reviewed
- 2026-07-13
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- corporate enterprise multi-vertical, government administration, professional services
- Target regions
- france, North America, Europe, global (12+ countries)
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Misconfigured Server Exposes Three Evilginx-Based Microsoft
Malware and tooling: Evilginx2-derived AiTM phishing kit, MaDoO Blaster, SimpleHelp, Xeox, black-queen, evilginx2 - S9003, red-queen
French security firm Lexfo discovered an exposed Python HTTP server with directory listing enabled that revealed the toolkits of three independent Microsoft 365 adversary-in-the-middle phishing operators — codemado, mail-argenta, and saroula01 — each running a custom Evilginx2 fork. Combined, the operators compromised 218+ corporate mailboxes across 12+ countries via reverse-proxy credential/session-cookie theft and OAuth device code flow abuse, with some stolen session tokens refreshed 25+ times and carrying one-year TTLs.
How Misconfigured Server Exposes Three Evilginx-Based Microsoft works
On April 30, 2026, a routine internet scan by French security firm Lexfo identified a misconfigured Python HTTP server (`python3 -m http.server 8080`) with directory listing enabled, hosted alongside active Microsoft 365 phishing infrastructure. The exposed directory leaked phishing configurations, credential logs, RMM installer binaries, combolists, backup archives, and an operator's Telegram session files, allowing researchers to attribute the infrastructure to three distinct threat actors operating independently but sharing tooling lineage from the open-source Evilginx2 adversary-in-the-middle (AiTM) proxy framework.
codemado (assessed Egyptian nationality) has been active in VoIP fraud and hacking forums since 2018, operates a phishing platform hosted on picis[.]net, and developed the MaDoO Blaster bulk mailer used for outbound phishing lure distribution — a tool later promoted within The Quarry phishing-as-a-service (PhaaS) Telegram ecosystem run by RockyBelling. codemado's campaign launched April 20, 2026 and used a CyberNeurova uncensored code-generation API to assist development.
mail-argenta (assessed Nigerian nationality) operates the red-queen Evilginx2 fork, discovered via credentials reused in infostealer logs (a reused MySQL database password tied the operator to the exposed server). The red-queen fork specifically evades Subresource Integrity (SRI) browser protections by renaming `crossorigin`/`integrity` HTML attributes during proxying and implements a custom URL-rewriting engine in `http_proxy.go` to defeat path-based phishing detection. A pre-compiled `evilginx2.exe` binary was committed directly to the operator's private repository. One captured Microsoft 365 session cookie carried a June 30, 2027 expiration date. The operator's own `instructions.txt` file, leaked in the exposure, contained verbatim output from an AI coding assistant session used to help build the fork's evasions.
saroula01 (unidentified, most prolific of the three) operates the black-queen Evilginx2 fork, which pivots away from classic reverse-proxy phishing toward abuse of Microsoft's OAuth 2.0 device code authorization flow (`microsoft.com/devicelogin`). Victims are presented an Authenticator-themed lure page that generates a genuine Microsoft device code and polls Microsoft's token endpoint upon victim MFA completion; because the login page and MFA challenge are entirely genuine Microsoft infrastructure, FIDO2/passkey origin-binding provides no protection — a real, benign-looking MFA challenge is completed by the victim while covertly authorizing the attacker's session. black-queen requests tokens using Microsoft's own first-party Office client ID (`d3590ed6-52b3-4102-aeff-aad2292ab01c`) and enables autorefresh on stolen tokens, with some sessions refreshed 25+ times, extending unauthorized access far beyond a typical token lifetime and evading password-reset-based remediation. The exposed logs documented 218 distinct captured Microsoft 365 accounts, 94% of which were corporate mailboxes, spanning 12+ countries with concentration in France and North America. Git history on saroula01's fork included two commits co-authored by an AI coding model, indicating AI-assisted development of glue code and phishlets (not core framework logic).
Across all three operators, post-compromise access was consolidated using legitimate remote monitoring and management (RMM) tooling for persistence rather than custom malware: a SimpleHelp remote console and a XEOX RMM agent installer (`C:\Program Files (x86)\XEOX\xeox-agent_x64.exe`, registered via a `*XEOX*Agent*Watchdog*` scheduled task) were recovered from the exposed server, consistent with the broader trend (also seen in CISA AA25-163A and The Quarry PhaaS ecosystem) of AiTM/phishing operators favoring off-the-shelf RMM software over bespoke malware to reduce EDR/AV detection surface. The primary attacker-controlled server was geolocated to Budapest (185.163.204.7), with a wildcard TLS certificate observed being renewed through May 2026 and new subdomains provisioned in May 2026. Both picis[.]net and romnor[.]ca phishing domains went offline shortly before public disclosure; whether this reflects operator-side infrastructure rotation or a takedown response is unclear as of publication.
The device code flow abuse technique mirrors TTPs previously documented by Microsoft for the Russia-aligned actor Storm-2372 (publicly reported February 2025), which used Microsoft Teams meeting-invite social engineering to lure victims into device code authentication and, in a February 2025 escalation, pivoted to using the Microsoft Authentication Broker client ID to obtain a Primary Refresh Token (PRT) and register attacker-controlled devices in Entra ID — indicating this abuse pattern has proliferated from a single nation-state actor to commodity/independent criminal operators within roughly a year.
MITRE ATT&CK techniques used in TL-2026-1258
Defense Evasion
Persistence
T1053.005 Scheduled Task; T1098.005 Device Registration; T1133 External Remote Services
Initial Access
T1078.004 Cloud Accounts; T1566 Phishing; T1566.002 Spearphishing Link
Privilege Escalation
Discovery
T1087.003 Email Account; T1526 Cloud Service Discovery
Command and Control
T1090.002 External Proxy; T1102 Web Service; T1219 Remote Access Tools
Credential Access
T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle; T1621 Multi-Factor Authentication Request Generation
Collection
T1114.002 Remote Email Collection
initial-access
Execution
Impact
lateral-movement
T1550.001 Application Access Token
Resource Development
T1583.001 Domains; T1586 Compromise Accounts; T1587.001 Malware; T1588.002 Tool
Reconnaissance
defense-impairment
Affected products and versions in Misconfigured Server Exposes Three Evilginx-Based Microsoft
- Microsoft — Microsoft 365 / Entra ID (OAuth 2.0 Device Authorization Grant flow)
Vulnerable versions: Device code flow enabled without Conditional Access restriction
Fixed in: Device code flow disabled or restricted via Conditional Access Policy - kgretzky — Evilginx2 (open-source AiTM phishing proxy, forked as red-queen and black-queen)
Vulnerable versions: All versions used as AiTM phishing infrastructure
Fixed in: N/A — legitimate red-team tool abused for criminal purposes - SimpleHelp — SimpleHelp RMM (used for post-compromise persistence in this campaign; separately affected by CVE-2024-57727/57726/57728 exploited by ransomware actors per CISA AA25-163A)
Vulnerable versions: 5.5.7 and earlier (unrelated CVE chain, cited for context)
Fixed in: Patched releases post CISA AA25-163A advisory - XEOX — XEOX RMM agent
Vulnerable versions: Any unauthorized/attacker-deployed installation
Fixed in: N/A — legitimate RMM abused for persistence
Remediation for Misconfigured Server Exposes Three Evilginx-Based Microsoft
Immediate actions
- Block Microsoft OAuth device code flow via Conditional Access Policy except for explicitly validated input-constrained/headless devices
- Force revocation and re-issuance of Microsoft 365 refresh tokens for any account flagged for device-code sign-in from unfamiliar geography or ASN
- Hunt endpoints for XEOX RMM agent artifacts (xeox-agent_x64.exe, *XEOX*Agent*Watchdog* scheduled task) and unauthorized SimpleHelp remote console installs
- Block known infrastructure: 185.163.204.7, picis[.]net, romnor[.]ca at perimeter/DNS/proxy
- Search Entra ID sign-in logs for Office client ID d3590ed6-52b3-4102-aeff-aad2292ab01c combined with device code 'Original transfer method'
Workarounds
- Disable legacy/device-code OAuth flow tenant-wide where no legitimate input-constrained-device use case exists
Longer-term hardening
- Deploy Continuous Access Evaluation (CAE) and IP-based/impossible-travel Conditional Access policies to shorten AiTM token abuse windows
- Move high-privilege accounts to FIDO2/passkey authentication and monitor for device-code flow fallback attempts as an evasion signal
- Establish periodic external attack-surface scanning to detect operator OPSEC failures (e.g., open directory listings) — not directly applicable to defenders but relevant to threat-hunting/takedown partners
- Deploy managed EDR policies that alert on unsanctioned RMM tool installation (SimpleHelp, XEOX, ScreenConnect) outside of IT change windows
Weaknesses (CWE) in Misconfigured Server Exposes Three Evilginx-Based Microsoft
CWE-287, CWE-346, CWE-1188
Timeline of Misconfigured Server Exposes Three Evilginx-Based Microsoft
- codemado launches phishing campaign using picis[.]net infrastructure and the MaDoO Blaster bulk mailer.
- Lexfo identifies a misconfigured Python HTTP server (directory listing enabled) hosting active Evilginx2-based phishing infrastructure during a routine internet scan.
- Wildcard certificate renewal is observed extending validity through May 2026, indicating continued operational investment.
- New subdomains and a wildcard TLS certificate are provisioned on the attacker-controlled Budapest server (185.163.204.7).
- Analysis of the exposed directory (configs, credential logs, RMM installers, combolists, backup archives, Telegram session files) attributes the infrastructure to three independent operators: codemado, mail-argenta, and saroula01.
- black-queen operator (saroula01) logs reach 218 distinct captured Microsoft 365 accounts (94% corporate) across 12+ countries, with some session tokens refreshed 25+ times.
- Both picis[.]net and romnor[.]ca phishing domains go offline shortly before public disclosure; cause (operator rotation vs. takedown) is unconfirmed.
- The Hacker News publishes coverage of Lexfo's findings, disclosing the three operators, their Evilginx2 forks (red-queen, black-queen), IOCs, and defensive recommendations.
Sources cited for Misconfigured Server Exposes Three Evilginx-Based Microsoft
- Misconfigured Server Reveals Three Evilginx-Based Microsoft 365 Phishing Operations
- Storm-2372 conducts device code phishing campaign
- Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers
- OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations
- Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider (AA25-163A)
- Ransomware Actors Exploit CVE-2024-57727 in Unpatched SimpleHelp RMM
- The Quarry: Inside the PhaaS Operation Behind Hundreds of IRS and SSA Phishing Campaigns
- Dark Web Profile: Rock
- evilginx2 — Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies
- Phishing: Pushing Evilginx to its limit
Threats related to Misconfigured Server Exposes Three Evilginx-Based Microsoft
- Misconfigured Python HTTP Server Exposes AiTM Phishing Toolkit Behind Three Active Campaigns (codemado, mail-argenta, saroula01)
- Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft 365 and Google Workspace OAuth Tokens to Bypass MFA
- "The Procurement Trap": AiTM Phishing-as-a-Service Campaign (EvilProxy, FlowerStorm/Storm-1167, Kali365) Targeting Universities, EU/UN Agencies, and Multinational Institutions
- Payroll Pirates (Storm-2755) Abuse Microsoft Graph for HR/Finance Staff Recon After AiTM Account Compromise
- Forg365 Phishing-as-a-Service Platform Uses AI-Generated Lures and AiTM/Device-Code Phishing to Compromise Microsoft 365 Accounts
- ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens Affiliate)
Detection coverage for TL-2026-1258
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1258 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.