Exposed Python Server Reveals Three Active AiTM Phishing Campaigns Security researchers at Lexfo uncovered a misconfigured Python HTTP server left exposed on a virtual private server (VPS), inadvertently revealing the inner workings of multiple adversary-in-the-middle (AiTM) phishing operations. The incident highlights how simple operational errors such as unsecured, forgotten infrastructure can provide defenders with rare insights into attacker tactics. The exposed server contained a full toolkit used to build, host, and maintain credential-theft lures, including phishing pages, login-relay components, and configuration files. Lexfo linked the materials to three distinct AiTM campaigns, a technique where attackers intercept authentication flows to steal credentials and session cookies, potentially bypassing multifactor authentication (MFA). While the campaigns shared infrastructure, researchers noted that this did not necessarily prove a single group was responsible. Instead, the overlap could indicate shared tools, rented services, or a single operator managing multiple efforts. The exposure also revealed testing assets and revisions, offering defenders a chance to identify related activity though such intelligence is time-sensitive, as attackers may remove or replace files once detected. The incident underscores the risks of overlooked web services, even temporary ones. A lightweight server used for file-sharing or testing can persist beyond its intended lifespan, creating unintended exposure. Organizations are advised to maintain accurate inventories of internet-facing assets, enforce strict access controls, and regularly review configurations to prevent similar leaks. AiTM phishing remains a persistent threat, as stolen session tokens can grant attackers access even when MFA is enabled. Defenders are encouraged to monitor for unusual sign-in patterns, unexpected session changes, and rapid post-authentication activity. While phishing-resistant MFA and session controls improve security, user vigilance such as verifying URLs before entering credentials remains critical. The case serves as a reminder that attackers’ own mistakes can expose their operations, and even minor, short-lived services can become significant security risks if left unchecked.