Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

A security firm, Lexfo, uncovered three separate phishing operations targeting Microsoft 365, all leveraging modified versions of the Evilginx proxy. These campaigns utilized a combination of traditional proxying and a novel technique exploiting Microsoft's device code flow, bypassing MFA. The attackers, led by Egyptian operator codemado (using the handle ‘codemado’ and the tool MaDoO Blaster), sourced their tools from public GitHub repositories and relied heavily on AI assistance in building custom components. The report highlights a growing ecosystem of readily available phishing-as-a-service, making it easier than ever for attackers to deploy sophisticated attacks, even with minimal technical expertise. Blocking device code flow through Conditional Access is the key defense.