Server Misconfiguration Exposed Three Phishing Campaigns Against Microsoft 365

The French cybersecurity firm Lexfo has uncovered three separate phishing operations targeting Microsoft 365 accounts. They were discovered thanks to a simple blunder by one of the attackers.

How the server was found

The operator of the phishing campaign launched a Python server on a publicly accessible port with the command python3 -m http.server 8080 — with the directory listing feature enabled. That same command was also left behind in a readable .bash_history file.

Because of this mistake, Lexfo's researchers gained access to the operator's entire toolkit used to carry out the attacks.

From one discovery to three campaigns

After examining the material they had obtained, Lexfo's specialists were able to trace the connections and identify two additional phishing operations. All three campaigns were built on Evilginx — a framework for carrying out adversary-in-the-middle attacks that allows attackers to intercept credentials and session tokens while bypassing two-factor authentication.

Why the discovery matters

The incident demonstrates how elementary lapses in the attackers' own operational security (OPSEC) can lead to the exposure of entire phishing infrastructures. Open access to the server's directories and an unprotected shell command history became the weak link that let researchers gain insight into the scale and methods of the operators' work.

For organizations that use Microsoft 365, the finding serves as a reminder of the ongoing threat of targeted phishing that employs Evilginx-class tools capable of bypassing traditional multi-factor authentication mechanisms.

Source: The Hacker News