The exposed phishing infrastructure shows how even attackers make basic security mistakes, and how much those mistakes can reveal about active campaigns.

Researchers found that a misconfigured Python HTTP server left running on a VPS exposed files connected to three active adversary-in-the-middle phishing operations. These campaigns were designed to steal login credentials, session cookies, and authentication tokens by placing fake login pages between the victim and the real service.

AiTM phishing is especially dangerous because it can bypass traditional multifactor authentication. If attackers capture a valid session token after the user completes MFA, they may be able to access the account without needing the password or second factor again.

This kind of access can lead to mailbox compromise, cloud account takeover, business email compromise, data theft, and lateral movement across SaaS platforms. For attackers, one stolen session can be more useful than one stolen password.

Organizations should monitor for suspicious sign-ins, impossible travel, new device registrations, mailbox forwarding rules, OAuth consent changes, unusual session reuse, and logins from unfamiliar residential proxy networks.

Defenses should include phishing-resistant MFA, conditional access, device compliance checks, session risk monitoring, short token lifetimes, and rapid revocation of suspicious sessions.

The key lesson is that phishing is no longer just about stealing passwords. Attackers are stealing authenticated sessions. A user may complete MFA correctly and still lose access if the login flow itself has been hijacked, because apparently even doing the right thing now requires the login page not to be a trap.

An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing switched on. The command that did it: python3 -m http.server 8080, was still sitting in the readable .bash_history. From that one lapse, French security firm Lexfo lifted the operator's entire toolkit and pivoted through it to two more

Source: Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 via The Hacker News — published 13 Jul 2026.