A Phishing Crew Forgot to Lock Its Own Front Door

Key points

• French security firm Lexfo uncovered three live Microsoft 365 phishing operations after one operator left a Python web server exposed on the public internet.
• The attackers were running Evilginx, a well-known kit that steals passwords and session cookies to bypass multi-factor authentication.
• Directory listing was switched on, meaning anyone visiting the server could browse the criminals' files like a public folder.
• A readable .bash_history file gave researchers the operator's exact steps and led them to two more crews.
• Even attackers targeting Microsoft 365 accounts make basic setup mistakes that expose their entire operation.

Here is a story about a criminal who forgot to lock the door of the room where he kept his tools.

French cybersecurity firm Lexfo was poking around the internet when it spotted a server running a live phishing operation aimed at Microsoft 365 accounts. Phishing is when criminals build fake login pages to trick people into typing real passwords.

The operator made two mistakes. First, they left directory listing switched on, which turns a web server into a browsable folder anyone can walk through. Second, they'd started the server with the one-line command python3 -m http.server 8080, which was still sitting in the shell history file. That file, .bash_history, is a diary of every instruction typed into the machine.

From that slip, Lexfo pulled the entire kit, then followed the trail to two more phishing crews running the same playbook. We first covered Evilginx on 13 July 2026, and MFA bypass techniques have now featured in 16 Threat Vectr stories since May.

How were the attackers stealing Microsoft 365 logins?

They were using Evilginx. It's a phishing kit that sits between the victim and the real Microsoft login page, acting as a middleman. When you type your password and approve the MFA prompt, Evilginx quietly copies the session cookie, the small file your browser uses to prove you're logged in, and hands it to the attacker.

That cookie is the prize. With it, the criminal walks into your mailbox without needing your password or your phone again. MFA doesn't stop this kind of attack on its own, a point our June story on device-code phishing made plain.

What was actually on the exposed server?

Because the folder was open to the world, researchers could see the whole workshop. That included Evilginx configuration files, victim lists, harvested credentials, and the operator's own notes. The .bash_history file showed the exact commands used to install and run the kit, which let Lexfo fingerprint similar setups elsewhere on the internet.

In plain terms: the attacker's toolbox and address book were sitting in a public cupboard.

Should ordinary Microsoft 365 users be worried?

Yes, though there's something practical you can do. Evilginx-style attacks usually arrive as an email asking you to sign in to view a document or a voicemail.

Check the web address before typing a password. If the domain isn't login.microsoftonline.com, close the tab. Phishing-resistant sign-in methods, passkeys and hardware security keys, don't hand over a stealable cookie the way a password and a code do, so turn them on if your IT team offers them.

For the criminals here, the lesson is simpler: don't leave your shell history where researchers can read it. The rest of us can enjoy the irony.