A cybercriminal running a Microsoft 365 phishing campaign left a public Python web server with directory listing enabled, exposing the operation. French security firm Lexfo seized the mistake, uncovered the full toolkit, and identified two additional campaigns.
Key Takeaways
- Server misconfiguration revealed three phishing operations
- Lexfo’s analysis uncovered two more hidden campaigns
- Microsoft 365 users must adopt stronger security controls
In cyber‑security, a single misconfiguration can open a gateway to massive data breaches. In this case, an attacker launched a simple Python command python3 -m http.server 8080, exposing a public web server on port 8080 with directory listing turned on. The server’s .bash_history retained the command, allowing researchers to trace the activity back to a live Microsoft 365 phishing operation.
Technical Details of the Misstep
The perpetrator leveraged the open‑source Evilginx framework, which captures user credentials by acting as a proxy between the victim and the legitimate service. By leaving the server publicly accessible, they inadvertently leaked the entire directory structure, making it trivial for analysts to download the malicious payloads and configuration files.
Lexfo’s Investigation and Findings
French cyber‑security firm Lexfo seized the opportunity to retrieve the exposed files. Their forensic team reconstructed the attacker’s toolkit and discovered that the single server hosted three distinct Evilginx phishing campaigns, two of which were previously unknown. The retrieved assets included phishing landing pages, credential‑stealing scripts, and configuration files that revealed the targeting logic for Microsoft 365 accounts.
Impact on Enterprises and Users
Targeting Microsoft 365 is especially lucrative because the suite integrates email, cloud storage, and collaboration tools under a single sign‑on. Successful compromise could grant attackers unfettered access to corporate communications, sensitive documents, and even financial data. This incident underscores that protecting cloud‑based services requires more than just email filters; it demands rigorous server hygiene and network segmentation.
Recommended Mitigations
Organizations should immediately audit any publicly exposed services, disable directory listings, and store shell histories in secured locations. Enforcing Multi‑Factor Authentication (MFA) across all Microsoft 365 accounts dramatically reduces the payoff of credential‑theft attacks. Regular penetration testing, continuous log monitoring, and adopting a zero‑trust architecture are essential to prevent similar oversights from becoming entry points for sophisticated phishing operations.
