One Open Server Exposed Three Live Phishing Operations

Exposed server in Budapest reveals three phishing campaigns with MFA-bypassing tactics, targeting victims across 12 countries.

By Content Team

Jul 13, 2026

ON THIS PAGE

A misconfigured Python HTTP server in Budapest with directory listing enabled handed researchers a full look inside three active phishing campaigns. The exposed server at 185.163.204.7 contained credential logs, phishing configs, RMM installers, combolists, and even the operator's own Telegram session files.

Three distinct threat actors were identified: codemado, an Egyptian operator whose Microsoft 365 AiTM campaign ran from January to May 2026; mail-argenta, a Nigerian operator undone by his own reused password, hardcoded in a public GitHub repo and later found in infostealer logs; and saroula01, whose Device Code Flow campaign quietly accumulated 218 victims across 12 countries over a year — 94% of them corporate accounts.

All three built their MFA-bypassing infrastructure from customised Evilginx forks pulled straight off public GitHub repositories, with minimal modification. The barrier to running these attacks is effectively zero.

Source: Lexfo Security Blog

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?