importantSYS.SOURCE: The Hacker News• 2026-07-13T13:00:00+05:30

Three Evilginx Phishing Campaigns Targeting Microsoft 365 Exposed via Misconfigured Server

#phishing #microsoft-365 #mfa-bypass #ai

A misconfigured server exposed three Evilginx phishing campaigns targeting Microsoft 365, utilizing MFA bypass techniques through proxy attacks and OAuth device code flows. The operations leveraged AI-assisted development and connected to a broader phishing-as-a-service ecosystem.

An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing switched on. The command that did it: python3 -m http.server 8080, was still sitting in the readable .bash_history.

From that one lapse, French security firm Lexfo lifted the operator's entire toolkit and pivoted through it to two more

Read original article

*** END OF TRANSMISSION ***

> FORG365 PHAAS EXPLOITS DEVICE CODE AND AITM TACTICS TO COMPROMISE MICROSOFT 365 ACCOUNTS > UBER'S ROBOTAXI LOBBYING STRATEGY CONTRASTS WITH WAYMO'S APPROACH IN D.C. REGULATORY BATTLE > SAN FRANCISCO POLICE DRONE SURVEILLANCE LEAK REVEALS UNINTENDED PUBLIC EXPOSURE OF AERIAL SURVEILLANCE DATA > META'S PATENT FOR CONTINUOUS AI EMOTIONAL MONITORING VIA VOICE AND BIOMETRICS > DOM-DOCX: MIT-LICENSED HTML TO NATIVE WORD DOCUMENT CONVERTER > USER'S FRUSTRATING DEPARTURE FROM ADOBE PHOTOSHOP AND CREATIVE CLOUD > SHIFTING FOCUS FROM CODE TO DESIGN IN AI-DRIVEN SOFTWARE DEVELOPMENT > INTEGRATING AUTONOMOUS AI AND ANALYST COPILOTS IN SECURITY OPERATIONS CENTERS > VOXEL TOKYO: REAL-TIME CULTURAL IMMERSION THROUGH URBAN SIMULATION AND LANGUAGE STUDY > AI-GENERATED POWERSHELL SCRIPT USED IN ACTIVE DIRECTORY ENUMERATION ATTACK> FORG365 PHAAS EXPLOITS DEVICE CODE AND AITM TACTICS TO COMPROMISE MICROSOFT 365 ACCOUNTS > UBER'S ROBOTAXI LOBBYING STRATEGY CONTRASTS WITH WAYMO'S APPROACH IN D.C. REGULATORY BATTLE > SAN FRANCISCO POLICE DRONE SURVEILLANCE LEAK REVEALS UNINTENDED PUBLIC EXPOSURE OF AERIAL SURVEILLANCE DATA > META'S PATENT FOR CONTINUOUS AI EMOTIONAL MONITORING VIA VOICE AND BIOMETRICS > DOM-DOCX: MIT-LICENSED HTML TO NATIVE WORD DOCUMENT CONVERTER > USER'S FRUSTRATING DEPARTURE FROM ADOBE PHOTOSHOP AND CREATIVE CLOUD > SHIFTING FOCUS FROM CODE TO DESIGN IN AI-DRIVEN SOFTWARE DEVELOPMENT > INTEGRATING AUTONOMOUS AI AND ANALYST COPILOTS IN SECURITY OPERATIONS CENTERS > VOXEL TOKYO: REAL-TIME CULTURAL IMMERSION THROUGH URBAN SIMULATION AND LANGUAGE STUDY > AI-GENERATED POWERSHELL SCRIPT USED IN ACTIVE DIRECTORY ENUMERATION ATTACK