One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators

Reported 13 Jul 2026 by otx · Severity: medium

A misconfigured Python HTTP server on a Budapest VPS exposed the complete operational infrastructure of three distinct phishing operators. The investigation uncovered codemado, an Egyptian threat actor operating since 2018, running a full AiTM platform with custom tools including