Exposed server unmasks three Evilginx phishing crews stealing Microsoft 365 sessions

A phishing operator left a Python web server exposed with directory listing on, letting researchers at Lexfo lift the entire toolkit and pivot to two more operators running three Microsoft 365 phishing campaigns. Each used a custom fork of the open-source Evilginx proxy to steal live session cookies and tokens, defeating multi-factor authentication by relaying the real login. The largest campaign ran over a year, logging 218 captured accounts, mostly corporate mailboxes, and a token file left in a public repository held 97 live Microsoft tokens. The report stresses two different MFA-bypass methods appeared, one proxying the real login and one abusing the device-code flow, which require different defenses to stop.

Check

Assess your Microsoft 365 defenses against both adversary-in-the-middle proxying and device-code abuse, hunt for suspicious token use and session reuse from unusual locations, and review Conditional Access coverage of the device-code flow.

Affected

Microsoft 365 organizations, especially corporate mailboxes; Evilginx-style proxies steal live session tokens to bypass MFA, and passkeys stop the proxy method but not the separate device-code abuse technique.

Fix

Enforce phishing-resistant authentication like passkeys against proxy phishing, use Conditional Access to block or limit the device-code flow, revoke suspicious sessions and tokens, and monitor sign-in logs for token reuse across locations.