As reported by The Hacker News, a threat actor running live Microsoft 365 adversary-in-the-middle (AiTM) phishing infrastructure made a cardinal operational security mistake — leaving a Python HTTP server exposed to the public internet with directory listing enabled. French security firm Lexfo turned the attacker's own sloppiness into a full intelligence windfall, pivoting from a single open port to three distinct phishing operations.

Threat Alert: As reported by The Hacker News, a threat actor running live Microsoft 365 adversary-in-the-middle (AiTM) phishing infrastructure made a cardinal operational security mistake — leaving a Python HTTP server exposed to the public internet with directory listing enabled.

This incident is a masterclass in irony: the same carelessness that makes end users susceptible to phishing was the undoing of the phisher themselves. But beyond the schadenfreude, there are serious and urgent lessons here for every organization running Microsoft 365.

Why This Matters

Evilginx is not a script-kiddie tool. It is a mature, actively maintained adversary-in-the-middle framework specifically engineered to defeat multi-factor authentication by proxying legitimate login flows and harvesting session cookies in real time. The fact that three separate campaigns were running concurrently signals either a single prolific operator or a small group with a systematic, production-grade phishing operation — not opportunistic attacks.

What makes AiTM phishing particularly dangerous in 2025 and beyond is the widespread — and dangerously false — belief that MFA is a complete defense. It is not. Evilginx-style frameworks capture the authenticated session token after the MFA challenge is satisfied. From the attacker's perspective, MFA simply becomes a minor friction point, not a barrier.

The threat model has shifted: Credential theft is no longer the end goal — session hijacking is. Organizations that haven't updated their detection and response posture accordingly are operating on outdated assumptions.

Who Is at Risk

Why This Matters
Microsoft 365 tenants of all sizes — M365 remains the single highest-value target for AiTM phishing due to its breadth of access (email, SharePoint, Teams, Azure AD, etc.)
Organizations relying solely on TOTP or push-based MFA — these are fully bypassable by Evilginx-style proxies
Finance, legal, and executive teams — historically the highest-priority targets for business email compromise that follows credential/session theft
SMBs without dedicated SOC capability — who are less likely to detect anomalous token reuse or impossible travel events

The Intelligence Value of Attacker Mistakes

From a threat intelligence perspective, this exposure is extraordinarily valuable. The .bash_history file alone can reveal attacker tooling, sequencing of operations, infrastructure setup patterns, and command preferences that inform attribution and detection engineering. The pivot from one exposed server to two additional campaigns demonstrates that phishing operators frequently reuse infrastructure, tooling configurations, and even phishlet templates across operations.

Defenders and threat intelligence teams should be actively scanning for misconfigured attacker infrastructure — open directory listings, exposed configuration files, and unauthenticated admin panels are not uncommon in rushed phishing deployments. Services like Shodan, Censys, and FOFA can surface these exposures, and collaborating with firms that perform this kind of proactive hunting can yield significant preemptive value.

Shield53 Recommendations

Immediate Actions for Microsoft 365 Defenders

  • Deploy phishing-resistant MFA: Migrate to FIDO2 hardware security keys (e.g., YubiKey) or Windows Hello for Business. These are cryptographically bound to the legitimate domain and cannot be proxied by Evilginx.
  • Enable Conditional Access with token binding and compliant device requirements: Require managed, compliant devices for M365 access — stolen session tokens replayed from unmanaged attacker infrastructure will fail device compliance checks.
  • Monitor for session anomalies: Implement detection rules for impossible travel, token reuse from new IP ranges, and sign-ins from Tor/VPN exit nodes or hosting ASNs not typical for your organization.
  • Enable Microsoft Entra ID Protection: Ensure risk-based Conditional Access policies are active and tuned to block or challenge high-risk sign-in events automatically.
  • Hunt for Evilginx infrastructure: Search your DNS and proxy logs for domains with Let's Encrypt certificates, low TTLs, and hosting on common VPS providers (Vultr, DigitalOcean, Hetzner) that mimic your login portals.
  • Audit your own exposed infrastructure: Run internal scans for accidentally exposed services — the attacker's mistake here is embarrassingly common among defenders too.

Longer-Term Strategic Guidance

  • Treat MFA bypass as a default threat assumption, not an edge case, in your security architecture reviews.
  • Incorporate AiTM phishing scenarios into tabletop exercises and red team engagements.
  • Subscribe to threat intelligence feeds that actively track phishing infrastructure, including Evilginx phishlet signatures and associated C2 IOCs.

The attacker's operational mistake handed researchers a rare window into live phishing operations. But defenders shouldn't need an attacker to trip over their own shoelaces. The controls to detect and prevent these campaigns exist today — the gap is consistently in deployment and configuration, not capability.