Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

A misconfigured server exposed three Evilginx phishing operations targeting Microsoft 365. The server was left listening on a public port with directory listing enabled due to a simple Python command. This mistake allowed a French security firm to access the attacker's toolkit. The firm, Lexfo, was able to pivot through the toolkit to discover two additional phishing operations. The error was discovered through a readable .bash_history file that still contained the command used to start the server. This single lapse provided significant insight into the attacker's activities.