One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators

The threat involves a misconfigured Python HTTP server that publicly exposed the complete infrastructure of three phishing operators running AiTM (Adversary-in-the-Middle) phishing campaigns. The operators—codemado (Egyptian, active since 2018), saroula01, and mail-argenta (Nigerian)—leveraged customized Evilginx forks and AI-assisted development to bypass MFA protections, primarily targeting Microsoft 365 accounts. The exposed server contained detailed operational data including phishing site configurations, credential logs, remote management tool installers, combolists, and Telegram session files. Saroula01's OAuth Device Code Flow attacks resulted in 218 victims across 12 countries over a year. Codemado is linked to the RockyBelling cybercrime ecosystem. The exposure reveals sustained phishing operations from early 2025 through mid-2026.

The exposure of the full phishing infrastructure allows defenders and law enforcement to analyze and potentially disrupt three active AiTM phishing campaigns. The operators targeted Microsoft 365 accounts with MFA bypass techniques, increasing the risk of credential theft and account compromise. The leak of credential logs and remote management tool installers indicates potential for widespread account takeovers and persistence. The campaigns affected victims in multiple countries, with at least 218 confirmed victims from saroula01's OAuth abuse. This exposure undermines the operators' ability to continue stealthy operations and may lead to takedowns or mitigations.

This threat results from a misconfiguration on the attackers' server rather than a vulnerability in legitimate software. There is no patch or fix applicable to defenders. Organizations should ensure robust MFA implementations and monitor for signs of AiTM phishing attacks, particularly targeting Microsoft 365 accounts. Awareness of OAuth Device Code Flow abuse and customized Evilginx phishing frameworks can aid detection. Since the exposed infrastructure is now public, defenders can use the leaked indicators and configurations to improve detection and response. No direct remediation is available for the exposed server itself.