Exposed Server Unmasks Evilginx Operators Stealing Microsoft 365 Sessions and OAuth Tokens

Gbhackers •Mayura Kathir • July 13, 2026

A misconfigured server in Budapest exposed a live phishing operation built to bypass Microsoft 365 multi-factor authentication and retain access to compromised accounts. The server, hosted at 185.163.204[.]7185.163.204[.]7185.163.204[.]7, was running python3 -m http.server 8080 with directory listing enabled, making its operational files publicly accessible. Researchers found phishing configurations, Telegram session artifacts, credential logs, RMM installers, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Misconfigured Server Exposes Evilginx Phishing Operations Targeting Microsoft 365 A misconfigured server in Budapest has exposed a phishing operation targeting Microsoft 365 users. The server was running a Python HTTP server with directory listing enabled, allowing access to phishing configurations and credential logs. Researchers identified three separate Evilginx operations leveraging this setup to bypass multi-factor authentication and steal OAuth tokens. The exposed server's IP address was 185.163.204. The incident highlights vulnerabilities in Microsoft 365's security measures. Currently, there are no specific CVEs reported, but the phishing campaigns are ongoing. Security professionals are urged to review their defenses against such tactics. The scope of impact includes any organization using Microsoft 365 that could fall victim to these phishing attempts. 4 sources 65

Extracted Entities

Exposed Server Unmasks Evilginx Operators Stealing Microsoft 365 Sessions and OAuth Tokens

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)