Evilginx and Device Code Phishing: Lessons from a Misconfigured Server

When a Simple Mistake Exposes a Web of PhishingIn the world of cybersecurity, sophisticated attacks often begin with the simplest of errors. Such was...

When a Simple Mistake Exposes a Web of Phishing

In the world of cybersecurity, sophisticated attacks often begin with the simplest of errors. Such was the case when a misconfigured web server—set up with a basic Python HTTP server and directory listing enabled—accidentally revealed the inner workings of three active phishing campaigns targeting Microsoft 365 users. The exposed files, including a revealing shell history, allowed researchers to reconstruct the attackers' infrastructure and tactics. This incident serves as a stark reminder that even minor oversights can have major consequences, and it offers valuable lessons for system administrators and businesses across Spain and beyond.

Two Attack Vectors That Bypass Traditional Defenses

The campaigns leveraged two primary techniques that are increasingly common in the threat landscape. The first is adversary-in-the-middle (AiTM) phishing using reverse proxies like Evilginx. This method intercepts the victim's session, captures cookies, and effectively bypasses multi-factor authentication (MFA) in interactive logins. The second, more subtle approach exploits the OAuth Device Code flow—the same mechanism used by microsoft.com/devicelogin—to obtain tokens without ever presenting a fake login page. This technique is particularly dangerous because it can succeed even when users are trained to spot phishing sites.

The Longevity of Stolen Tokens

One of the most alarming findings was the lifespan of the stolen tokens. Researchers discovered cookies with expiration dates set for 2027, meaning that once an attacker gains access, they can maintain it for years if no additional controls are in place. In one campaign, over 200 confirmed victims across a dozen countries were identified, with a majority being corporate mailboxes. This highlights the importance of not only preventing initial compromise but also limiting the damage through proactive session management.

From Credential Theft to Full Control

The attackers didn't stop at stealing credentials. They deployed remote monitoring and management (RMM) tools to maintain persistent access, turning compromised mailboxes into launching pads for further attacks within the organization. This shift from credential theft to sustained control underscores the need for comprehensive incident response that goes beyond password resets.

Defending Against Reverse Proxy Phishing

To counter AiTM phishing, organizations should deploy phishing-resistant MFA methods such as FIDO2 security keys or passkeys. These technologies significantly reduce the effectiveness of cookie theft during interactive logins, as they bind authentication to the device and the user's physical presence. While no solution is foolproof, implementing these measures can dramatically lower the risk of session hijacking.

Mitigating Device Code Abuse

For the Device Code flow, the approach is different. Administrators should disable this flow in Microsoft Entra ID unless there is a genuine operational need. If exceptions are necessary, they should be minimal and tightly scoped to specific devices or applications. Additionally, robust Conditional Access policies—including location-based restrictions and Continuous Access Evaluation—can help truncate the effective lifespan of stolen tokens, limiting the window of opportunity for attackers.

Monitoring and Responding to Suspicious Activity

Proactive monitoring is essential. Organizations should audit token grants associated with the Device Code flow and watch for unusual session origins. In particular, look for refresh token grants tied to client IDs that are not typically used by your environment, and cross-reference them with suspicious IPs or ASNs. If suspicious activity is detected, the response should be immediate and thorough: revoke sessions and refresh tokens, enforce reauthentication via Conditional Access, and investigate endpoints for unauthorized RMM tools.

Building a Resilient Security Posture

This incident is a powerful illustration of how attackers chain together deception, token theft, and persistence to compromise cloud environments. For businesses in Catalonia and across Spain, the lessons are clear: invest in phishing-resistant MFA, enforce strict token policies, and maintain vigilant monitoring. Centralizing security management across your servers can also help. Solutions like Abuse Shield offer automated IP blocking, managed fail2ban, and a shared reputation feed, providing a unified defense layer that reduces the attack surface and helps you respond faster to threats. By adopting a proactive and layered security strategy, you can protect your organization from these evolving threats and ensure that a simple misconfiguration doesn't lead to a major breach.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.