In the world of cybersecurity, the battle against phishing attacks is an ongoing challenge. A recent discovery by French security firm Lexfo has shed light on a sophisticated operation involving misconfigured servers and phishing campaigns targeting Microsoft 365 users. This article delves into the details of the attack, the techniques employed, and the implications for defenders.
The Misconfigured Server and Phishing Operation
The story begins with a misconfigured server that revealed a Python web server with directory listing enabled, exposing sensitive information such as phishing configurations, credential-harvesting logs, and more. This server was part of a live Microsoft 365 phishing operation, and its misconfiguration provided a unique opportunity for researchers to uncover a larger threat landscape.
Lexfo's investigation led them to three Evilginx phishing operations, each running a custom fork of the open-source Evilginx proxy cloned from public GitHub repositories. The largest of these operations had been running for over a year, targeting corporate mailboxes.
Techniques and Defenses
The attackers employed two distinct techniques to bypass Multi-Factor Authentication (MFA). One method involved proxying the live login, while the other abused a legitimate Microsoft sign-in flow. These techniques highlight the importance of understanding the specific defenses required for each approach.
The Power of Directory Listing
Directory listing on a compromised server is a significant security breach. It provides attackers with a treasure trove of information, including phishing configurations, credential-harvesting logs, and more. This level of exposure demonstrates the importance of securing servers and the potential consequences of negligence.
The Operators and Their Connections
The operators behind these phishing campaigns were identified as codemado, an Egyptian actor active in VoIP and hacking forums since 2018. Lexfo's investigation revealed that codemado did not build the frameworks used in the attacks but rather cloned them from other GitHub developers. This highlights the ease with which attackers can access and adapt existing tools.
AI-Assisted Development
Interestingly, the report found signs of AI-assisted development across all three operations. While the extent of AI involvement varies, it underscores the growing role of artificial intelligence in cyberattacks. The use of AI in phishing campaigns raises concerns about the future of cybersecurity and the need for adaptive defenses.
The Device Code Phishing Technique
One of the most intriguing aspects of the attack was the device code phishing technique employed by the 'black-queen' operator. This method involves generating a real device code, wrapping it in an Authenticator-themed lure page, and tricking victims into entering it on a genuine Microsoft page. The technique bypasses MFA and relies on the victim clearing it on genuine Microsoft infrastructure.
The Growing Threat Landscape
The report concludes that the barrier to a working phishing campaign has fallen to near zero. The availability of pre-built kits, the use of AI, and the ease of access to public repositories have contributed to the increasing sophistication and frequency of phishing attacks. Defenders must remain vigilant and adapt their strategies to counter these evolving threats.
Recommendations for Defenders
To protect against these attacks, defenders should focus on implementing phishing-resistant MFA, using FIDO2 or passkeys, and leveraging Conditional Access policies. Blocking device code flow and monitoring for suspicious activities, such as refresh-token grants from the Microsoft Office client ID, are crucial steps in strengthening defenses.
In conclusion, the discovery of these phishing operations highlights the evolving nature of cyber threats and the need for constant vigilance. As attackers continue to adapt and innovate, defenders must stay ahead of the curve to safeguard their systems and users.
