Misconfigured Python Server Exposes Three Distinct Evilginx Forks Targeting M365

Lexfo's April 2026 scan found directory listing enabled on the Budapest host, revealing credential logs, RMM binaries, and Telegram artifacts alongside four Evilginx variants. The primary operator, tracked as codemado, had cloned public repos and operated picis[.]net with MaDoO Blaster mailer; captured tokens showed repeated refreshes against French and North American corporate tenants. Two additional forks originated from mail-argenta and saroula01, each with distinct modifications including attribute renaming, URL rewriting, and one-year cookie TTLs that bypass standard password resets absent CAE policies.