Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

A security oversight by an attacker exposed a significant phishing operation targeting Microsoft 365 users. A misconfigured server left a Python web server running on a public port, revealing the attacker's tools and techniques. French security firm Lexfo discovered this and used the exposed data to identify two additional phishing schemes orchestrated by the same operator. This incident underscores the importance of secure server configurations and the ongoing threat of phishing attacks against major cloud services like Microsoft 365.