The recent discovery of a misconfigured server has revealed a sophisticated phishing operation targeting Microsoft 365. This operation, led by an Egyptian actor known as codemado, showcases the evolving tactics and tools used by cybercriminals. The server's public accessibility and directory listing exposed a wealth of sensitive information, including phishing configurations, credential-harvesting logs, and even the operator's Telegram session files.
What makes this case particularly intriguing is the use of Evilginx, an open-source proxy tool, and its custom forks. Codemado, rather than building the framework from scratch, cloned it and made modifications to suit his needs. This approach highlights the ease of access to advanced cyber tools and the potential for rapid development and deployment of phishing campaigns.
The report details three distinct phishing operations, each utilizing a different fork of Evilginx. The first, red-queen, is associated with a Nigerian operator named mail-argenta. This fork includes enhancements such as URL-rewriting and the ability to pre-fill victim email addresses, making it more effective in bypassing security measures.
The second operation, black-queen, employs a unique approach by leveraging Microsoft's OAuth device code flow. This method, while legitimate, is being misused to bypass multi-factor authentication (MFA). The attacker creates a lure page that mimics the Microsoft Authenticator, tricking users into entering a device code. Once entered, the attacker can take control of the session, even if the victim has a passkey or FIDO2 key.
The use of AI in these operations is also noteworthy. The report identifies signs of AI-assisted development, with some operators using AI models to generate code and improve their phishing panels. This trend is not limited to these three cases, as Microsoft has documented similar AI-driven phishing campaigns.
From a defensive perspective, the report emphasizes the importance of implementing phishing-resistant MFA, FIDO2, or passkeys. However, it also highlights the need for Conditional Access policies to block device code abuse. By combining these measures, organizations can significantly enhance their security posture against these sophisticated phishing attacks.
In conclusion, this incident underscores the dynamic nature of cyber threats and the need for organizations to stay vigilant. As the barrier to entry for launching phishing campaigns continues to decrease, it is crucial to adopt a multi-layered security approach to protect against these evolving threats.
