Three Evilginx Operations Hit Microsoft 365

French security firm Lexfo uncovered three Evilginx phishing campaigns targeting Microsoft 365 after finding a misconfigured server with directory listing enabled. The largest campaign ran over a year, targeting corporate mailboxes. Two distinct MFA bypass techniques were used: credential proxying and Microsoft's OAuth device code flow. The operators remain unidentified.