Mirage2FA Hijacks Microsoft 365 Sessions Over 4K Victims in the US

On 2026-08-20, Any Run published a detailed threat report that links the Mirage2FA phishing‑as‑a‑service (PhaaS) kit to more than 4,500 compromised Microsoft 365 accounts across the United States. The operation uses an Adversary‑in‑the‑Middle (AiTM) flow to capture user credentials, one‑time authentication codes, and live session cookies, thereby bypassing standard multi‑factor authentication (MFA) controls.

Key TTPs

• Delivery via malicious .htm, .xhtml, or .svg attachments and QR‑code lures.
• Browser‑executed stagers that load an obfuscated JavaScript module from a /xls/.js endpoint.
• AiTM reverse proxy that relays credentials to Microsoft 365 over a WebSocket channel.
• Immediate theft of session cookies, passwords, and 2FA codes, then exfiltration to the operator panel.

Attack Flow

1. Phishing email with a .htm or QR‑code link arrives in the victim’s inbox.
2. Victim opens the attachment or scans the QR code, triggering the embedded browser stager.
3. The stager retrieves a per‑recipient token (e.g., LINXB64EMAIL) and loads /xls/.js from the C2 domain.
4. A fake Microsoft login page is displayed; the attacker captures the username, password, and 2FA code.
5. Credentials are relayed in real time to Microsoft 365 over a WebSocket, allowing the attacker to obtain a valid authenticated session.
6. Session cookies and credentials are exfiltrated to the operator’s control panel.
7. The attacker can now assume the victim’s identity, read mail, and move laterally across connected SSO services.

Victim Landscape

Data from the report shows 63.7% of identified victims are located in the United States (2,885 accounts). The campaign also reached India, Singapore, the United Kingdom, Canada, Saudi Arabia, and South Africa, totaling 94 countries. Industries most affected include Technology (19.2%), Manufacturing (11.1%), Education (9.9%), Consulting (8.3%), Telecommunications (6.6%) and Health (5.4%).

Compromise Outcomes

The dataset contains 9,332 potential compromise events distributed as follows:

• Session cookie theft – 4,561 events (2,541 unique victims)
• Password/2FA compromise – 3,044 events (1,589 unique victims)
• SSO login – 1,339 events (616 unique victims)
• Other outcomes – 388 events (270 unique victims)

Technical Signatures

Key indicators include:

• Loader requests matching /[a-z]{3}/xls/[a-z0-9]+(?:c2v|cpt)?\.js on domains such as *.cheacker.store or *.volatilesour.store.
• Out‑bound WebSocket connections to the C2 host immediately after the loader is fetched.
• HTML attachments containing an obfuscated XOR + Base64 eval sequence (key 0xAD).
• SVG documents with an inline