Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

Back Thehackernews

Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

Thehackernews •[email protected] (The Hacker News) • July 13, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Misconfigured Server Exposes Evilginx Phishing Operations Targeting Microsoft 365 A misconfigured server in Budapest has exposed a phishing operation targeting Microsoft 365 users. The server was running a Python HTTP server with directory listing enabled, allowing access to phishing configurations and credential logs. Researchers identified three separate Evilginx operations leveraging this setup to bypass multi-factor authentication and steal OAuth tokens. The exposed server's IP address was 185.163.204. The incident highlights vulnerabilities in Microsoft 365's security measures. Currently, there are no specific CVEs reported, but the phishing campaigns are ongoing. Security professionals are urged to review their defenses against such tactics. The scope of impact includes any organization using Microsoft 365 that could fall victim to these phishing attempts. 4 sources 65

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

T1566 - Phishing

Platforms (1)

Tools (1)