Loading threat actor…
mail-argenta is a suspected Nigerian cybercriminal operator and phishing-kit developer associated with adversary-in-the-middle phishing operations and session theft. The actor is linked to the customized Evilginx fork known as red-queen and to a broader ecosystem of publicly hosted phishing tooling targeting Microsoft 365 and other online services, including cryptocurrency platforms, consumer web services, and social-networking accounts. Attribution to Nigeria is supported by reused credentials exposed in infostealer logs and Git commit metadata. The actor maintained numerous public code repositories used to support phishing activity against Microsoft 365, Kraken, Bybit, LinkedIn, eHarmony, iCloud, Google-related services, GitHub, and other brands. mail-argenta’s red-queen modifications included URL rewriting to evade path-based detection, changes intended to defeat Subresource Integrity protections, victim email prefilling to reduce abandonment, and long-lived captured-session settings designed to preserve stolen Microsoft 365 sessions for extended periods. A precompiled build of the phishing framework was also distributed, lowering the barrier for downstream use. mail-argenta also operated a phishing panel targeting cryptocurrency users, including a Kraken-focused man-in-the-middle panel with real-time session handling and backend credential storage. Confirmed victim captures tied to this actor included sessions from Microsoft 365, Google, Kraken, Bybit, iCloud, and eHarmony. Reported campaign data indicates at least 15 confirmed victims in one observed operation. The actor’s tradecraft centers on MFA bypass through session theft rather than direct credential-only compromise. Observed behavior includes phishing infrastructure development, initial access via phishing, theft of authenticated sessions, and collection of victim data from multiple online platforms. Development artifacts also indicate use of generative AI assistance for tooling customization. mail-argenta appears linked to the other operators codemado and saroula01 through shared public tooling and technical overlap rather than confirmed joint operational control.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Suspected operator running phishing panels that captured sessions from crypto exchanges, Google, iCloud, and Microsoft 365 accounts.
Cybercriminal phishing operator maintaining public GitHub repositories and credential/session theft infrastructure targeting cloud, social, and crypto services; associated with the red-queen Evilginx fork.
A phishing operator linked through reused credentials found in infostealer logs and a hardcoded MySQL password in a phishing panel; associated through cloned Evilginx code lineage rather than proven operational coordination.
Operating and developing a customized Evilginx phishing kit for Microsoft 365 that modifies HTML attributes to evade Subresource Integrity checks, rewrites URLs to avoid path-based detection, pre-fills victim email addresses, and extends captured cookie lifetime.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.