Misconfigured Python Server Exposes Three Active Evilginx Phishing Campaigns Targeting Microsoft 365
French researchers uncovered a publicly exposed Python HTTP server that revealed the full toolset of three separate Evilginx‑based phishing operators targeting Microsoft 365 users. The dump included configs, logs, RMM installers and Telegram sessions, showing how each actor bypasses MFA with custom AiTM setups. The find highlights the danger of simple misconfigurations exposing entire attack infrastructures.