Hackers are using a sophisticated phishing-as-a-service platform called Mirage2FA to target Microsoft 365 users and steal authenticated sessions even after victims successfully complete multi-factor authentication (MFA). Researchers at ANY.RUN found that the Adversary-in-the-Middle (AiTM) framework has generated thousands of potential compromise events from late 2024 through 2026. Instead of directly breaking MFA, the attackers wait for users to complete the normal Microsoft 365 login process. They then secretly capture the authenticated session, giving them a way to access accounts without asking for MFA again.
The attack works by placing Mirage2FA between the victim and the legitimate Microsoft authentication service, allowing the attackers to relay information in real time. When an employee enters corporate credentials and a one-time passcode into the fake login portal, the toolkit forwards that information to the genuine Microsoft 365 service. A persistent WebSocket connection helps maintain communication between the phishing infrastructure and the legitimate authentication process. After Microsoft approves the login and creates session tokens, the attackers intercept and keep the authenticated session cookies together with the stolen credentials.
These stolen session cookies can be extremely valuable because they can allow attackers to act as an already authenticated user. Researchers found that compromised sessions could provide access to Microsoft 365 mailboxes, SharePoint repositories, OneDrive documents and enterprise applications connected through Single Sign-On (SSO). This means the attacker may not need to trigger another MFA request after taking over the active session. ANY.RUN attributed the activity to a threat group known as LinX Coders, with indicators including configuration tags such as LINXCODERSEMAIL and backend channels linked to the operation.
The scale of the activity shows how widely these automated phishing tools are being used against organizations. Sandbox telemetry identified 3,518 unique email domains and 9,426 targeted accounts, with around 4,532 addresses showing clear signs of potential compromise. Organizations in the United States represented 63.7 percent of the identified victims, while activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia and South Africa. The technology industry was the largest targeted sector at 19.2 percent, followed by manufacturing at 11.1 percent and education at 9.9 percent.
The analysis also recorded 9,332 compromise events, including 4,561 cases involving stolen session cookies across 2,541 unique victims. Mobile devices were involved in about one-third of successful logins, which can make these attacks more effective because suspicious URLs may be harder to notice on smaller screens. The campaign primarily focuses on Microsoft 365 and Entra ID SSO environments, where stolen authentication sessions can provide direct access to cloud resources. The growing availability of phishing-as-a-service platforms is making this type of attack easier for more cybercriminals to use.
Mirage2FA can operate without installing traditional binary malware on the victim’s device. Attackers have used phishing emails containing HTM, XHTML and SVG attachments, as well as links disguised as legitimate corporate communications such as HR updates and retirement benefit notices. When opened, these files can execute scripts inside the browser and retrieve additional phishing components from attacker-controlled infrastructure. The HTML content uses obfuscation techniques, including Base64 decoding and XOR operations, while SVG-based lures can use scripts to redirect victims to an active phishing site.
Security teams therefore need to look beyond simple password theft when investigating Microsoft 365 compromises. Researchers noted that hunting only for changing phishing domains may not be enough because attackers can rotate their infrastructure quickly. Suspicious script requests and unexpected WebSocket connections following script retrieval can provide useful detection signals. More importantly, simply changing a compromised password may not immediately remove an attacker who already possesses a valid session token, because the stolen session can remain usable until it is revoked or expires.
Organizations should respond quickly when a Microsoft 365 session is suspected of being stolen by invalidating active sessions and refresh tokens and reviewing OAuth permissions across the affected account. Security teams should also inspect accounts for unauthorized activity and consider phishing-resistant authentication methods such as FIDO2 security keys. Microsoft Entra ID’s Continuous Access Evaluation (CAE) can also help reduce the usefulness of stolen sessions by allowing access decisions to respond to important security changes. The Mirage2FA activity is another reminder that completing MFA does not always mean an account is safe when attackers are stealing the authenticated session itself.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
