Open Directory Exposes Three Evilginx Phishing Operators

French firm Lexfo found a misconfigured public Python HTTP server exposing phishing configurations, credential logs, RMM tools and operator session files tied to three actors (codemado, mail-argenta, saroula01). The activity included an Evilginx-based AiTM proxy, a custom bulk-mailer and infostealer artefacts, and a device-code OAuth campaign that ran for over a year, capturing tokens from 218 corporate victims across 12 countries and allowing tokens to be refreshed repeatedly.