News › security
By Zayden R., July 13, 2026
A misconfigured server exposed a running Microsoft 365 phishing operation. Lexfo discovered the breach, uncovering the attacker's toolkit and linking it to two additional operations.
In a surprising turn of events, a misconfigured server inadvertently unveiled three ongoing Microsoft 365 phishing operations. The French security firm Lexfo stumbled upon the situation when they discovered a Python web server left listening on a public port, with directory listing carelessly enabled. The command responsible, python3 -m http.server 8080, was found in the operator's bash_history, offering a telling glimpse into the attacker's oversight.
This lapse allowed Lexfo to not only lift the entire toolkit used in the phishing operation but also trace connections to two additional operations. Such careless exposure is rare, yet it underscores the persistent threat posed by phishing campaigns targeting Microsoft 365 users, who are often the gatekeepers to valuable enterprise data.
The discovery of this server is a stark reminder of the importance of proper server configuration and monitoring. Leaving a web server open in such a manner is akin to leaving the door wide open for anyone to walk in. For sysadmins, this serves as a cautionary tale; ensuring that servers are properly configured and secured is paramount to maintaining the integrity of sensitive operations.
While the immediate impact on users was mitigated by Lexfo's intervention, the incident highlights the ongoing cat-and-mouse game between security professionals and malicious actors. The tools and techniques used in these operations continue to evolve, but so too must the vigilance of those tasked with defending against them.
The Linux Camp teaches these topics as hands-on labs on real virtual machines, verified as you type.