Misconfigured Server Exposes Three Evilginx Phishing Ops Targeting M365

Lexfo discovered that an attacker accidentally exposed a public HTTP directory (via 'python3 -m http.server') containing a readable .bash_history, which revealed three active Evilginx-based Microsoft 365 phishing campaigns. The report explains how Evilginx acts as an adversary-in-the-middle to capture session cookies and bypass MFA, outlines the attack flow, lists mitigations (phishing-resistant MFA, conditional access, token protection, domain intelligence, and user training), and highlights OPSEC lessons and the value of scanning exposed infrastructure.