# Misconfigured Server Exposes Three Evilginx-Based Microsoft 365 Phishing Operations (codemado, mail-argenta, saroula01)

> French security firm Lexfo discovered an exposed Python HTTP server with directory listing enabled that revealed the toolkits of three independent Microsoft 365 adversary-in-the-middle phishing operators — codemado, mail-argenta, and saroula01 — each running a custom Evilginx2 fork. Combined, the operators compromised 218+ corporate mailboxes across 12+ countries via reverse-proxy credential/session-cookie theft and OAuth device code flow abuse, with some stolen session tokens refreshed 25+ times and carrying one-year TTLs.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1258
- **ID:** TL-2026-1258
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On April 30, 2026, a routine internet scan by French security firm Lexfo identified a misconfigured Python HTTP server (`python3 -m http.server 8080`) with directory listing enabled, hosted alongside active Microsoft 365 phishing infrastructure. The exposed directory leaked phishing configurations, credential logs, RMM installer binaries, combolists, backup archives, and an operator's Telegram session files, allowing researchers to attribute the infrastructure to three distinct threat actors operating independently but sharing tooling lineage from the open-source Evilginx2 adversary-in-the-middle (AiTM) proxy framework.

codemado (assessed Egyptian nationality) has been active in VoIP fraud and hacking forums since 2018, operates a phishing platform hosted on picis[.]net, and developed the MaDoO Blaster bulk mailer used for outbound phishing lure distribution — a tool later promoted within The Quarry phishing-as-a-service (PhaaS) Telegram ecosystem run by RockyBelling. codemado's campaign launched April 20, 2026 and used a CyberNeurova uncensored code-generation API to assist development.

mail-argenta (assessed Nigerian nationality) operates the red-queen Evilginx2 fork, discovered via credentials reused in infostealer logs (a reused MySQL database password tied the operator to the exposed server). The red-queen fork specifically evades Subresource Integrity (SRI) browser protections by renaming `crossorigin`/`integrity` HTML attributes during proxying and implements a custom URL-rewriting engine in `http_proxy.go` to defeat path-based phishing detection. A pre-compiled `evilginx2.exe` binary was committed directly to the operator's private repository. One captured Microsoft 365 session cookie carried a June 30, 2027 expiration date. The operator's own `instructions.txt` file, leaked in the exposure, contained verbatim output from an AI coding assistant session used to help build the fork's evasions.

saroula01 (unidentified, most prolific of the three) operates the black-queen Evilginx2 fork, which pivots away from classic reverse-proxy phishing toward abuse of Microsoft's OAuth 2.0 device code authorization flow (`microsoft.com/devicelogin`). Victims are presented an Authenticator-themed lure page that generates a genuine Microsoft device code and polls Microsoft's token endpoint upon victim MFA completion; because the login page and MFA challenge are entirely genuine Microsoft infrastructure, FIDO2/passkey origin-binding provides no protection — a real, benign-looking MFA challenge is completed by the victim while covertly authorizing the attacker's session. black-queen requests tokens using Microsoft's own first-party Office client ID (`d3590ed6-52b3-4102-aeff-aad2292ab01c`) and enables autorefresh on stolen tokens, with some sessions refreshed 25+ times, extending unauthorized access far beyond a typical token lifetime and evading password-reset-based remediation. The exposed logs documented 218 distinct captured Microsoft 365 accounts, 94% of which were corporate mailboxes, spanning 12+ countries with concentration in France and North America. Git history on saroula01's fork included two commits co-authored by an AI coding model, indicating AI-assisted development of glue code and phishlets (not core framework logic).

Across all three operators, post-compromise access was consolidated using legitimate remote monitoring and management (RMM) tooling for persistence rather than custom malware: a SimpleHelp remote console and a XEOX RMM agent installer (`C:\Program Files (x86)\XEOX\xeox-agent_x64.exe`, registered via a `*XEOX*Agent*Watchdog*` scheduled task) were recovered from the exposed server, consistent with the broader trend (also seen in CISA AA25-163A and The Quarry PhaaS ecosystem) of AiTM/phishing operators favoring off-the-shelf RMM software over bespoke malware to reduce EDR/AV detection surface. The primary attacker-controlled server was geolocated to Budapest (185.163.204.7), with a wildcard TLS certificate observed being renewed through May 2026 and new subdomains provisioned in May 2026. Both picis[.]net and romnor[.]ca phishing domains went offline shortly before public disclosure; whether this reflects operator-side infrastructure rotation or a takedown response is unclear as of publication.

The device code flow abuse technique mirrors TTPs previously documented by Microsoft for the Russia-aligned actor Storm-2372 (publicly reported February 2025), which used Microsoft Teams meeting-invite social engineering to lure victims into device code authentication and, in a February 2025 escalation, pivoted to using the Microsoft Authentication Broker client ID to obtain a Primary Refresh Token (PRT) and register attacker-controlled devices in Entra ID — indicating this abuse pattern has proliferated from a single nation-state actor to commodity/independent criminal operators within roughly a year.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583.001 Domains
- T1587.001 Malware
- T1588.002 Tool
- T1586 Compromise Accounts
- T1566.002 Spearphishing Link
- T1566 Phishing
- T1078.004 Cloud Accounts
- T1204.001 Malicious Link
- T1133 External Remote Services
- T1053.005 Scheduled Task
- T1098.005 Device Registration
- T1078.004 Cloud Accounts
- T1550.001 Application Access Token
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1199 Trusted Relationship
- T1111 Multi-Factor Authentication Interception
- T1528 Steal Application Access Token
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1621 Multi-Factor Authentication Request Generation
- T1526 Cloud Service Discovery
- T1087.003 Email Account
- T1114.002 Remote Email Collection
- T1090.002 External Proxy
- T1219 Remote Access Tools
- T1102 Web Service
- T1531 Account Access Removal

## Sources

- [Misconfigured Server Reveals Three Evilginx-Based Microsoft 365 Phishing Operations](https://thehackernews.com/2026/07/misconfigured-server-reveals-three.html)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers](https://thehackernews.com/2025/12/russia-linked-hackers-use-microsoft-365.html)
- [OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)
- [Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider (AA25-163A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a)
- [Ransomware Actors Exploit CVE-2024-57727 in Unpatched SimpleHelp RMM](https://www.picussecurity.com/resource/blog/ransomware-actors-exploit-cve-2024-57727-in-unpatched-simplehelp-rmm)
- [The Quarry: Inside the PhaaS Operation Behind Hundreds of IRS and SSA Phishing Campaigns](https://socradar.io/blog/the-quarry-phaas-irs-ssa-phishing/)
- [Dark Web Profile: Rock](https://socradar.io/blog/dark-web-profile-rock/)
- [evilginx2 — Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies](https://github.com/kgretzky/evilginx2)
- [Phishing: Pushing Evilginx to its limit](https://www.riskinsight-wavestone.com/en/2025/07/phishing-pushing-evilginx-to-its-limit/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1258