Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
Mirage2FA phishing-as-a-service campaign hit ~4,500 organizations, mostly US, stealing Microsoft 365 passwords and session cookies to bypass 2FA.
ANY.RUN research links the Mirage2FA phishing-as-a-service toolkit to 4,532 unique organization email domains between 2024 and 2026, with the US accounting for 63.7% of victims. The kit uses adversary-in-the-middle login flows to harvest credentials and session cookies, bypassing MFA on Microsoft 365 accounts. Researchers recorded more than 9,000 potential compromise events and estimated 48% of targeted email addresses were potentially compromised. Hijacked sessions extend to SSO-connected services, enabling impersonation, fraud and further compromise.
- 4,532 unique organization domains linked; technology, manufacturing and education most targeted
- 63.7% of victims in the US; others in India, Singapore, UK, Canada and more
- AiTM proxy pages capture passwords and session cookies, defeating traditional MFA
- Recommendations: phishing-resistant authentication, session revocation, behavioral detection
- ATT&CK
- T1566.002 Spearphishing LinkT1557 Adversary-in-the-MiddleT1539 Steal Web Session CookieT1550.004 Web Session Cookie
- Products
- Microsoft 365
- Malware
- Mirage2FA
- Countries
- United States
From the original article
3 min read at thehackernews.com
Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. According to ANY.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.