{
  "name": "One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators",
  "slug": "one-misconfigured-server-three-active-campaigns-full-exposure-of-three-aitm-phishing-operators",
  "description": "A misconfigured Python HTTP server on a Budapest VPS exposed the complete operational infrastructure of three distinct phishing operators. The investigation uncovered codemado, an Egyptian threat actor operating since 2018, running a full AiTM platform with custom tools including MaDoO Blaster; saroula01, deploying OAuth Device Code Flow attacks that accumulated 218 victims across 12 countries over a year; and mail-argenta, a Nigerian operator identified through infostealer logs containing his own credentials. All three actors leveraged customized Evilginx forks and AI-assisted development to build MFA-bypass infrastructure from public GitHub repositories. The campaigns targeted Microsoft 365 accounts primarily, with codemado maintaining ties to RockyBelling's \"The Quarry\" cybercrime ecosystem. The exposed server contained phishing configurations, credential logs, RMM installers, combolists, and Telegram session files, revealing sustained operations from at least January 2025 through May 2026.",
  "published": "2026-07-13T10:36:53.340000+00:00",
  "created_at": "2026-07-13T10:52:54.584000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-13T10:52:54.584000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "aitm",
    "asyncrat",
    "evilginx",
    "madoo blaster",
    "oauth abuse",
    "phishing infrastructure",
    "rmm tools"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "66a27570-e359-4a8d-9c40-40e6619283da",
        "name": "83.136.211.85"
      },
      {
        "id": "37b8124d-6948-47de-acda-50ba0442f6e8",
        "name": "mejeff.picis.net"
      },
      {
        "id": "fbee0e33-4fc7-4de3-8e24-990ddef2790e",
        "name": "hervw2.picis.net"
      },
      {
        "id": "9a590677-b2a4-4d85-a73b-726f89467207",
        "name": "queeenspropertyservices.ca"
      },
      {
        "id": "94eccfc9-40e7-497d-9782-513ce6376d41",
        "name": "http://team.romnor.ca/go"
      },
      {
        "id": "9aad16c2-c06a-420d-a090-e64494924b0c",
        "name": "team.romnor.ca"
      },
      {
        "id": "2aea2dc5-44fa-45e5-9449-be4495396bd7",
        "name": "share.romnor.ca"
      },
      {
        "id": "e92a23c7-b8ec-4bf8-89e0-b87c7ac646d5",
        "name": "events.api.picis.net"
      },
      {
        "id": "326d2847-1a0d-4514-8198-754416f9038a",
        "name": "jrhte.picis.net"
      },
      {
        "id": "d870765e-e820-4fe2-9aaf-5fedd4a3f0ba",
        "name": "http://briefing.romnor.ca/go"
      },
      {
        "id": "631201fc-deb3-485d-91f8-c5fe218d014d",
        "name": "216.180.245.166"
      },
      {
        "id": "02cc9cdc-ea27-498e-a532-9f1555b868ee",
        "name": "hrvetbr.picis.net"
      },
      {
        "id": "5dd23144-7513-4d7b-849d-01be29f83a99",
        "name": "verify.picis.net"
      },
      {
        "id": "c1d4b931-a4a2-4e12-98a2-aa8648f1434b",
        "name": "sso.picis.net"
      },
      {
        "id": "4b372b11-56cc-4abf-9513-841d980ac697",
        "name": "hterw.picis.net"
      },
      {
        "id": "b4aa2ab0-0b60-4147-8851-6f24bcfa57f7",
        "name": "188.227.196.240"
      },
      {
        "id": "ffca2971-1509-4b95-a0a5-824e9b449d88",
        "name": "cdn.picis.net"
      },
      {
        "id": "7e610838-c671-4f9c-b3b8-182ae948302b",
        "name": "w4j1q.picis.net"
      },
      {
        "id": "9841d756-bdd4-4ec2-938e-6fcfe8b28576",
        "name": "hvr34gr.picis.net"
      },
      {
        "id": "6191d309-0f9a-49d3-9d58-f1749a28ab3b",
        "name": "roweri.picis.net"
      },
      {
        "id": "e8c744d8-a449-45b3-bc9e-6ccd9d273673",
        "name": "http://share.romnor.ca/go"
      },
      {
        "id": "5c6e94fe-c6ba-4950-8323-157bcc1b971f",
        "name": "agent01.xeox.com"
      },
      {
        "id": "3390e903-436d-4136-86ca-6c485782bffc",
        "name": "vinicious.picis.net"
      },
      {
        "id": "357f841c-bd8e-4963-8255-7ed62e8c8bc8",
        "name": "b8c4u.picis.net"
      },
      {
        "id": "d1571e35-33a0-4f8d-af82-e36e32c0035b",
        "name": "http://account.romnor.ca/go"
      },
      {
        "id": "ccecc7eb-685c-433a-ac54-a400879fe672",
        "name": "htejre.picis.net"
      },
      {
        "id": "ec0bc04e-0e0f-40d4-a8ee-128c005001b6",
        "name": "80.80.250.0/24"
      },
      {
        "id": "d83d2670-7579-4129-be06-8566990c0150",
        "name": "h6y2s.picis.net"
      },
      {
        "id": "e71e078a-4cd4-4ca5-9fea-07274201c4d1",
        "name": "v3n8p.picis.net"
      },
      {
        "id": "7e080793-15a9-4cac-b01f-eaa8dc120c40",
        "name": "account.picis.net"
      },
      {
        "id": "8bd75f89-b27d-486b-b7da-d3dc3533e105",
        "name": "sign.romnor.ca"
      },
      {
        "id": "f0c7ed53-3bf5-41f2-8af9-f5d2029f4dfb",
        "name": "l5p0n.picis.net"
      },
      {
        "id": "a262ddb3-d2e5-49f1-bcbf-586d20c5974b",
        "name": "http://download.romnor.ca/go"
      },
      {
        "id": "5fe0e243-84e2-495c-8826-6f0a62477578",
        "name": "accounts.picis.net"
      },
      {
        "id": "41e2e28a-6c34-440d-afb7-a595fc8bec2a",
        "name": "q4b7j.picis.net"
      },
      {
        "id": "008cfa0c-04e3-46be-bec2-c9d946338b45",
        "name": "c9x3h.picis.net"
      },
      {
        "id": "b2f1b8d6-2a33-4dc7-9c7d-edc693c6df13",
        "name": "outi.picis.net"
      },
      {
        "id": "ea04d32d-3f2e-40c6-ad6e-2d55295d97f5",
        "name": "e2a6m.picis.net"
      },
      {
        "id": "a638e7d5-5d05-4f6f-b12a-9fc02bc7c72f",
        "name": "hervw.picis.net"
      },
      {
        "id": "98b8c39b-2575-4127-b498-8d39438a6d00",
        "name": "gui.picis.net"
      },
      {
        "id": "3679ac25-420f-4d02-aa55-ee8f2dca3219",
        "name": "f3d9v.picis.net"
      },
      {
        "id": "899b4c8a-0b18-454b-863d-164ff967e4b9",
        "name": "track.picis.net"
      },
      {
        "id": "bf63d4dc-af0a-4d9a-b465-bbb731ccf96a",
        "name": "k9m2x.picis.net"
      },
      {
        "id": "b2ecdc51-ebe4-4da5-b924-6920f9bb0516",
        "name": "picis.net"
      },
      {
        "id": "1d9556a6-3cbd-4d4c-a7a4-f2aad367d8df",
        "name": "portal.xeox.com"
      },
      {
        "id": "ac21639f-2a18-489b-89fd-9f95223dd751",
        "name": "romnor.ca"
      },
      {
        "id": "8b252323-201f-46b6-a95c-8856ed340de8",
        "name": "simple.run"
      },
      {
        "id": "db62b223-0cf3-484e-a75e-4f579bc687ac",
        "name": "7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0"
      },
      {
        "id": "3178ba57-2e5a-4be4-ab59-e088bf72b154",
        "name": "img6.picis.net"
      },
      {
        "id": "03d0d2b7-975b-434e-b97e-95d22e933db5",
        "name": "http://verify.picis.net/verify-human"
      },
      {
        "id": "01e93bcf-a9a6-4bdf-9aa6-990fbbec44e1",
        "name": "owa.picis.net"
      },
      {
        "id": "a60e1396-e8da-4b46-80a7-2e1cc619a39d",
        "name": "ws01.xeox.com"
      },
      {
        "id": "26c90252-f549-4669-8749-d25da83fbbc2",
        "name": "download.romnor.ca"
      },
      {
        "id": "60b63a51-dc6a-4d8c-bf4c-abdf34fefbae",
        "name": "ewfweo.picis.net"
      },
      {
        "id": "07d669cc-3153-4b0c-8bd6-0a4818f14066",
        "name": "hnrvrve.picis.net"
      },
      {
        "id": "38fe2c3b-d576-4704-852a-cc464bf5d7b1",
        "name": "billing.picis.net"
      },
      {
        "id": "3c6bd69c-25c3-4bc1-ba61-076369bc5f3a",
        "name": "t5z1r.picis.net"
      },
      {
        "id": "d5d56791-bcc8-420e-8352-a7a3b0f8985c",
        "name": "briefing.romnor.ca"
      },
      {
        "id": "48e00a70-3abd-4775-8e6d-91220ec37197",
        "name": "img1.picis.net"
      },
      {
        "id": "ff1e585c-a348-4bc2-b674-753d20bfb6b9",
        "name": "secure.picis.net"
      },
      {
        "id": "886f8d3f-f71c-4d8e-a37f-d3c33c1add5f",
        "name": "g7k1w.picis.net"
      },
      {
        "id": "641d5acd-eef8-4067-b723-ab641e53c913",
        "name": "http://sign.romnor.ca/go"
      },
      {
        "id": "ad9140cb-4235-494f-b1e9-ab9c2517948a",
        "name": "hcwdg.picis.net"
      },
      {
        "id": "d19407d1-90ab-49ce-81d0-f753e4262f0c",
        "name": "account.romnor.ca"
      }
    ],
    "intrusion_sets": [
      {
        "id": "9915d0d7-9b29-4e59-96dc-0114589d395d",
        "name": "codemado",
        "slug": "codemado"
      }
    ],
    "attack_patterns": [
      {
        "id": "7e3e3784-9547-42ca-b888-482972d14be3",
        "name": "T1528"
      },
      {
        "id": "63567f6b-fd33-4e9f-b631-48dd6fd02c21",
        "name": "T1557.002"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "5bab4974-1fc2-4144-b093-28ebcb8767dc",
        "name": "T1114"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "886bf3fa-4e64-498b-9cba-f64619cfd501",
        "name": "T1090.002"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "6fad55e3-6abc-46aa-b5af-23923e5d6485",
        "name": "T1110.004"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "436e795b-553f-444e-b837-65818d8f539f",
        "name": "T1119"
      }
    ],
    "malware": [
      {
        "id": "16f35db4-1cec-4936-afb4-a0e2c2d70bb2",
        "name": "MaDoO Blaster",
        "slug": "madoo-blaster"
      },
      {
        "id": "f200fb60-5446-493f-9712-9f26d65956cc",
        "name": "AsyncRAT",
        "slug": "asyncrat"
      },
      {
        "id": "5829c22a-34b2-47d4-b21b-5b60f4fa431b",
        "name": "Evilginx",
        "slug": "evilginx"
      }
    ],
    "observables": [
      {
        "id": "270d540c-e1a2-4fa8-9335-c32e6f30b040",
        "name": "simple.run"
      },
      {
        "id": "87c6b756-7035-420e-921f-6b0ea2f55565",
        "name": "picis.net"
      },
      {
        "id": "157c1844-4f28-487a-a94b-e78f67a45f5e",
        "name": "romnor.ca"
      },
      {
        "id": "6c28c906-f6ff-4b81-8738-ec1d39171960",
        "name": "queeenspropertyservices.ca"
      },
      {
        "id": "cde6d732-8811-48bc-af1b-871e32832fa2",
        "name": "v3n8p.picis.net"
      },
      {
        "id": "54973f86-a9dc-4c4a-a07c-821cc50caa3d",
        "name": "briefing.romnor.ca"
      },
      {
        "id": "41f49c7e-3e94-4a05-ac58-7aaf24d72aca",
        "name": "events.api.picis.net"
      },
      {
        "id": "ae8f7661-28eb-47d8-8c95-5965946c56b9",
        "name": "img6.picis.net"
      },
      {
        "id": "170ac34e-0dbd-4aa1-ad14-75523fc6b047",
        "name": "hterw.picis.net"
      },
      {
        "id": "cdbf5129-2226-427f-8754-e82935b75dd5",
        "name": "cdn.picis.net"
      },
      {
        "id": "7a0cc64c-23e5-4d31-a03b-8e1eb7d366db",
        "name": "img1.picis.net"
      },
      {
        "id": "dbf5eb92-b1ce-4a3a-ba3f-fc3a4a2a8d64",
        "name": "verify.picis.net"
      },
      {
        "id": "8cc18adf-c171-46e2-870c-396783534231",
        "name": "ewfweo.picis.net"
      },
      {
        "id": "ab16d427-1d2c-4b9f-a26f-9064921c0ae6",
        "name": "mejeff.picis.net"
      },
      {
        "id": "7ed23ac3-438b-407f-b872-53489afa21fa",
        "name": "roweri.picis.net"
      },
      {
        "id": "c4db4bee-18f5-401f-bc9e-685de57319b6",
        "name": "e2a6m.picis.net"
      },
      {
        "id": "716a257b-d4f0-46aa-b54f-cbf9862f38da",
        "name": "hcwdg.picis.net"
      },
      {
        "id": "84218fa6-cfd7-4683-a46d-2b44040fbc09",
        "name": "account.romnor.ca"
      },
      {
        "id": "ea23341d-7c3a-4e81-a1c1-751a6a31d287",
        "name": "billing.picis.net"
      },
      {
        "id": "ab652b24-9f74-472f-9a2c-469c42f29c69",
        "name": "secure.picis.net"
      },
      {
        "id": "a914a536-bccb-4dc5-b858-485c511966ab",
        "name": "gui.picis.net"
      },
      {
        "id": "5007ba66-2f04-470d-8a25-1fc46f15321d",
        "name": "owa.picis.net"
      },
      {
        "id": "5ff37b9b-d376-4ceb-9770-81045e92550c",
        "name": "accounts.picis.net"
      },
      {
        "id": "878f2c45-8c1d-483c-a5c3-cafe1157eca6",
        "name": "q4b7j.picis.net"
      },
      {
        "id": "c4136c7f-96ca-4bc1-b5ed-f6d401dc0e78",
        "name": "htejre.picis.net"
      },
      {
        "id": "ca9e125a-9995-4960-bfa3-7d217c38ad0b",
        "name": "team.romnor.ca"
      },
      {
        "id": "d51175a0-5f45-4133-847e-50bfeeda1ff9",
        "name": "f3d9v.picis.net"
      },
      {
        "id": "728373e1-7437-4313-9821-b7b38a17f4c5",
        "name": "jrhte.picis.net"
      },
      {
        "id": "648851df-91c8-4f21-b5c2-3d046ee189c5",
        "name": "t5z1r.picis.net"
      },
      {
        "id": "1b81e0cf-6968-4241-863d-fb5035b248d0",
        "name": "hnrvrve.picis.net"
      },
      {
        "id": "a53d6fc1-2e63-457c-bc5a-bf4585626cda",
        "name": "vinicious.picis.net"
      },
      {
        "id": "37f8bbba-21c4-4a2d-8d95-a744d239b66f",
        "name": "w4j1q.picis.net"
      },
      {
        "id": "f7d658aa-f739-46e9-9be5-d2fcf1a1a450",
        "name": "share.romnor.ca"
      },
      {
        "id": "da9a986a-53d1-4192-a54f-6734f5b261a6",
        "name": "hervw.picis.net"
      },
      {
        "id": "87c694be-3bae-4190-9d30-ff89c0435bd1",
        "name": "b8c4u.picis.net"
      },
      {
        "id": "fd6d90aa-1fd9-4a9e-8993-7aa70790c949",
        "name": "h6y2s.picis.net"
      },
      {
        "id": "7ec298cd-0dd4-458c-9455-eff1fcfad66e",
        "name": "l5p0n.picis.net"
      },
      {
        "id": "2ab1569d-5808-4601-960e-28ab66e07cca",
        "name": "download.romnor.ca"
      },
      {
        "id": "1e9d3fc3-ef59-4eca-a1e6-908e63710517",
        "name": "ws01.xeox.com"
      },
      {
        "id": "78575762-fb7a-4e7b-b21d-770f32eceec6",
        "name": "hervw2.picis.net"
      },
      {
        "id": "d23f0f9c-0e10-4bdd-8379-370108795a8d",
        "name": "k9m2x.picis.net"
      },
      {
        "id": "fa735a1f-ca50-4e94-a1eb-34c4e4e9cfed",
        "name": "g7k1w.picis.net"
      },
      {
        "id": "a1d3e817-286c-4d64-ab6c-98c905154f4a",
        "name": "hrvetbr.picis.net"
      },
      {
        "id": "9b9947d4-9ec9-4ce6-a0ad-7615aade6311",
        "name": "outi.picis.net"
      },
      {
        "id": "6c4dcf56-d1fb-438f-acf6-e0f7e6bcc1a8",
        "name": "c9x3h.picis.net"
      },
      {
        "id": "3b84d406-3d4f-42c6-bf53-b0aad3f2fae8",
        "name": "portal.xeox.com"
      },
      {
        "id": "ec01dbce-5521-43f9-8abf-a3feda40de26",
        "name": "sso.picis.net"
      },
      {
        "id": "950c029f-da08-40e4-aea1-45eab41f37aa",
        "name": "agent01.xeox.com"
      },
      {
        "id": "3618e2ab-122c-4b1f-b2ad-b23a80a65374",
        "name": "account.picis.net"
      },
      {
        "id": "07ab387b-61c9-42b7-b9cd-3d465ffcaa27",
        "name": "hvr34gr.picis.net"
      },
      {
        "id": "483dcda7-d492-414f-9ecf-dffb406d1c77",
        "name": "sign.romnor.ca"
      },
      {
        "id": "3b6662f0-826a-4332-8c23-82474c326e20",
        "name": "track.picis.net"
      },
      {
        "id": "9bbd15b0-a7e0-4f47-be3b-e5dd88f9e795",
        "name": "188.227.196.240"
      },
      {
        "id": "1df315ab-677f-4a60-81d9-5b7e0f187e32",
        "name": "83.136.211.85"
      },
      {
        "id": "52e0bfaa-f15d-4ef1-9837-2e84e32921f6",
        "name": "216.180.245.166"
      },
      {
        "id": "7b39a558-4ac9-4c20-90c0-d45554dc2329",
        "name": "80.80.250.0/24"
      },
      {
        "id": "95c888f3-a693-4d2b-b346-f73d630e014c",
        "name": "http://download.romnor.ca/go"
      },
      {
        "id": "b79d18b3-c269-4271-b39a-27147a9de515",
        "name": "http://verify.picis.net/verify-human"
      },
      {
        "id": "06196083-cedd-45af-b39b-b0d3a5019ddf",
        "name": "http://share.romnor.ca/go"
      },
      {
        "id": "a31e071c-8900-43f7-8603-54ef2354d24e",
        "name": "http://sign.romnor.ca/go"
      },
      {
        "id": "62fcaf68-b984-4fd6-a1e9-b2f6c4825226",
        "name": "http://account.romnor.ca/go"
      },
      {
        "id": "d0526bda-a88f-4c5e-a2ac-4fa0d3e44d18",
        "name": "http://briefing.romnor.ca/go"
      },
      {
        "id": "c91dd892-290c-43d2-8a06-7ff977f415c8",
        "name": "http://team.romnor.ca/go"
      }
    ]
  },
  "external_refs": [
    {
      "id": "e4170d6a-5202-4621-96bc-13f4246e9d87",
      "standard_id": "external-reference--e049b89b-1ea7-5366-aad4-761c0b049a14",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://blog.lexfo.fr/opendir-to-phishing-operator.html",
      "hash": null,
      "external_id": null,
      "created": "2026-07-13T10:52:50.172Z",
      "modified": "2026-07-13T10:52:50.172Z",
      "createdById": null
    },
    {
      "id": "179d7cc3-b2ed-4489-a5a1-2147d4a82f08",
      "standard_id": "external-reference--efcde9cd-3907-5ac3-a037-d16001eb1826",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a54bfc57c70fae743cb883e",
      "hash": null,
      "external_id": "6a54bfc57c70fae743cb883e",
      "created": "2026-07-13T10:52:50.137Z",
      "modified": "2026-07-13T10:52:50.137Z",
      "createdById": null
    }
  ]
}