OTX Threat: One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators

A misconfigured Python HTTP server on a Budapest VPS exposed the complete operational infrastructure of three distinct phishing operators. The investigation uncovered codemado, an Egyptian threat actor operating since 2018, running a full AiTM platform with custom tools including MaDoO Blaster; saroula01, deploying OAuth Device Code Flow attacks that accumulated 218 victims across 12 countries ove Sectors: Finance, Technology, Government