What Happened
The Mirage2FA campaign emerged as a large‑scale phishing‑as‑a‑service (PhaaS) platform that targets Microsoft 365 accounts. By exploiting legitimate login flows, the toolkit enables attackers to bypass multi‑factor authentication (MFA) and steal authenticated session cookies. Recent research shows that the campaign has affected more than 4,500 organizations across the US and EU, with roughly 48% of targeted email addresses potentially compromised.source
Technical Analysis
Mirage2FA operates through an adversary‑in‑the‑middle (AiTM) technique. Victims receive malicious HTML or SVG attachments that render a fake Microsoft 365 login page. When the user enters credentials and completes the MFA challenge, the toolkit proxies the data to the real Microsoft authentication service over a persistent WebSocket channel. The legitimate authentication response, including session tokens, is intercepted and streamed back to the attacker, who then captures the authenticated session cookie.source This approach allows the attacker to hijack an active session without needing to crack the second factor directly.
Detailed sandbox analysis by ANY.RUN revealed that the malicious payloads employ multiple obfuscation layers – Base64 encoding, XOR with key 0xAD, and eval‑based execution – to hide the JavaScript loader that fetches second‑stage scripts from attacker‑controlled infrastructure (e.g., user.cheacker.store). The loader then initiates the WebSocket tunnel that carries the authentication flow.source
Who’s Affected
The impact spans a wide range of industries, with the technology sector representing the largest share (≈19% of victims), followed by manufacturing and education. Geographic analysis shows that 63.7% of compromised organizations are based in the United States, while the remaining victims are distributed across India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other regions.source The campaign has generated more than 9,000 potential compromise events, including over 4,500 cookie‑theft incidents, 3,000 password or MFA code captures, and 1,300 SSO logins.
How to Protect Yourself
Enforce Phishing‑Resistant Authentication: Deploy hardware security keys (FIDO2) or password‑less authentication methods that do not rely on credential entry in a web form.
Monitor Session Activity: Enable Continuous Access Evaluation (CAE) in Microsoft Entra ID to automatically invalidate compromised tokens.
Revoke Stolen Sessions Immediately: Upon detection of suspicious activity, force password resets, invalidate refresh tokens, and audit OAuth grants.
Implement Advanced Email Filtering: Block HTML/SVG attachments and sandbox suspicious files before they reach end users.
Educate Users on AiTM Threats: Train staff to recognize subtle differences in login pages, such as mismatched URLs or unexpected CAPTCHA screens.
The Sable Angle
At Sable we help startups and enterprises harden their identity infrastructure. Our penetration‑testing‑as‑a‑service includes simulated AiTM attacks to verify that MFA implementations resist session‑hijacking techniques like those used by Mirage2FA. Learn more about our pricing and see case studies in our research hub.
By integrating continuous monitoring, hardware‑based authentication, and proactive threat‑hunting, organizations can reduce the attack surface that Mirage2FA exploits and protect critical data stored in Microsoft 365.source
