[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYR_kDLJf5yuEiYDYjE_fvFhAlcynKMZ3or8DTzfGun8":3,"$fx0ZwrfDGg2hfgqkWwpn14oLmlFZmZU-_Pnl8CD2jPhk":63},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":59,"created_at":60,"updated_at":61,"published_at":62},"mirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm","Mirage2FA Phishing Toolkit Hijacks 4,500 Microsoft 365 Sessions via AiTM","ANY.RUN research identifies 4,532 victims (63.7% US) across 2024–2026 with 9,332 compromise events including 4,561 cookie-theft and 3,044 password\u002F2FA captures.","Mirage2FA is an active phishing-as-a-service toolkit that hijacks Microsoft 365 sessions via Adversary-in-the-Middle, bypassing MFA to steal credentials, 2FA codes, and session cookies from 4,500+ US and EU organizations.",[10,11,12,13,14],"phishing","m365","aitm","mfa-bypass","us-victims","# Mirage2FA Phishing Toolkit Hijacks 4,500 Microsoft 365 Sessions via AiTM\n\n*ANY.RUN research identifies 4,532 victims (63.7% US) across 2024–2026 with 9,332 compromise events including 4,561 cookie-theft and 3,044 password\u002F2FA captures.*\n\n**Tags:** `phishing` `m365` `aitm` `mfa-bypass` `us-victims`\n\n> Mirage2FA is an active phishing-as-a-service toolkit that hijacks Microsoft 365 sessions via Adversary-in-the-Middle, bypassing MFA to steal credentials, 2FA codes, and session cookies from 4,500+ US and EU organizations.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-15981 | 9.8 | 0.8% | — | — | 54.28 (Medium) |\n| CVE-2026-61979 | 8.1 | 0.3% | — | — | 46.63 (Medium) |\n\n## Mirage2FA Hijacks Microsoft 365 Sessions\n\nMirage2FA is a commercial phishing-as-a-service toolkit designed to steal Microsoft 365 credentials and authenticated sessions via Adversary-in-the-Middle (AiTM) attacks. The kit intercepts login credentials, 2FA codes, and session cookies in the browser, bypassing MFA before the user completes the second factor.\n\nANY.RUN analyzed 1,249 sandbox sessions and linked the campaign to 9,332 potential compromise events across 4,532 victims. The dataset breaks down into 4,561 cookie-theft events, 3,044 password\u002F2FA events, 1,339 SSO logins, and 388 other outcomes. The campaign also touched 3,518 unique organization email domains.\n\n63.7% of identified victims are in the United States, with the remainder in EU corporate environments. Targeted industries span Consulting, Education, Finance, Health, Manufacturing, Technology, and Telecommunications. Delivery is browser-based: .htm, .xhtml, and .svg stagers, QR codes, JavaScript obfuscation, and WebSocket-based AiTM relay keep the attack running inside the browser without a binary payload.\n\n## How the AiTM Flow Steals Sessions\n\nDelivery is entirely browser-based. The kit ships as a set of stagers — .htm, .xhtml, and .svg files — that the victim’s browser executes directly. The .svg stager carries a QR code for mobile handoff, while the .htm and .xhtml payloads run obfuscated JavaScript to set up the relay. No binary payload is dropped to disk; the whole attack lives in the browser tab.\n\nThe authentication flow runs over a WebSocket-based AiTM relay. Once the victim hits the login page, the relay proxies the M365 SAML\u002FWS-Federation exchange, captures the 2FA code, and pulls the authenticated session cookie before the user sees the success page. This is what lets the attacker reuse the cookie to hijack the active session after MFA completes.\n\nThe loader pattern is a recurring \u002Fxls\u002F endpoint that pulls the main stager. The kit also carries LINX markers in the stager headers and relay config, tying the build to LinX Coders. The \u002Fxls\u002F path and marker strings are consistent across the 1,249 sandbox sessions ANY.RUN analyzed.\n\n## 4,500 Orgs Hit Across 2024–2026\n\nThe campaign reached 3,518 unique organization email domains, giving it broad reach across US and EU corporate environments. ANY.RUN identified 9,426 unique targeted emails, which the team describes as a high compromise rate for a browser-based AiTM kit.\n\nThe 9,332 total compromise events break down into 4,561 cookie-theft events, 3,044 password\u002F2FA events, 1,339 SSO logins, and 388 other outcomes. Cookie theft is the dominant outcome, consistent with the kit’s design to pull the authenticated session cookie after MFA completes.\n\nActivity ramped sharply through 2026, with victim data concentrated in the United States. The campaign has been active since 2024, and the 2026 wave accounts for the bulk of the 4,532 victims and 9,332 events in the dataset.\n\n## Who Was Targeted\n\nThe campaign hit seven industries: Consulting, Education, Finance, Health, Manufacturing, Technology, and Telecommunications. Technology and Manufacturing were the primary targets, with Education and Finance also prominent in the victim set.\n\nGeographically, 63.7% of identified victims were in the United States, with the remaining ~36% in EU corporate environments. The US concentration aligns with the campaign’s focus on Microsoft 365 accounts used for daily operations in those sectors.\n\nCompromise outcomes were led by session theft, followed by password\u002F2FA and SSO logins. The 4,561 cookie-theft events make session theft the dominant result, consistent with the kit’s design to pull the authenticated session cookie after MFA completes.\n\n## Key points\n\n- Mirage2FA is a commercial PhaaS toolkit targeting Microsoft 365 via AiTM, bypassing MFA to steal credentials, 2FA codes, and session cookies.\n- 4,532 unique victims identified (63.7% US) across 2024–2026, with 9,332 compromise events: 4,561 cookie-theft, 3,044 password\u002F2FA, 1,339 SSO logins, 388 other.\n- Browser-based delivery uses .htm\u002F.xhtml\u002F.svg stagers, QR codes, JS obfuscation, and WebSocket-based AiTM relay — no binary malware.\n- 3,518 unique organization email domains linked, showing broad reach across US and EU corporate environments.\n- Campaign linked to LinX Coders via recurring infrastructure markers; active since 2024 with sharp increase in 2026.\n\n## Further reading & sources\n\n- [Mirage2FA: A Phishing Threat to US Companies with 4K Victims](https:\u002F\u002Fany.run\u002Fcybersecurity-blog\u002Fmirage2fa-phishing-targets-us-companies) — ANY.RUN\n- [Mirage2FA hits 4,500 orgs; Oracle Weblogic RCE](https:\u002F\u002Fdefend.network\u002Fbriefings\u002Fmirage2fa-oracle-weblogic-nvidia-nemo-wordpress-2026-08-26.html)\n- [Release Notes: Faster TI Investigations & 650+ Threat Updates](https:\u002F\u002Fany.run\u002Fcybersecurity-blog\u002Frelease-notes-august-2026)\n- [Major Cyber Attacks in August 2026: US & EU Threats](https:\u002F\u002Fany.run\u002Fcybersecurity-blog\u002Fmajor-cyber-attacks-august-2026)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm.png?v=66142d32cc",{"cves":18,"malware":34,"targets":37,"industries":43,"techniques":48,"technologies":53},[19,28],{"id":20,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},"CVE-2026-15981",false,"\u002Fvulnerabilities\u002FCVE-2026-15981",9.8,0.0188,"Medium",54.34,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":31,"epss":32,"risk_band":25,"risk_score":33,"cvss_version":27},"CVE-2026-61979","\u002Fvulnerabilities\u002FCVE-2026-61979",8.1,0.0037,46.64,[35],{"name":36},"Mirage2FA",[38],{"name":39,"sector":40,"status":41,"geography":42},"Microsoft 365","SaaS","confirmed","US",[44],{"url":45,"name":46,"slug":47},"\u002Findustries\u002Fsoftware-saas","Software & SaaS","software-saas",[49],{"id":50,"url":51,"name":52},"T1557","\u002Fmitre-attack\u002Ftechniques\u002FT1557","Adversary-in-the-Middle",[54,57],{"vendor":55,"product":56},"ANY.RUN","Threat Intelligence Lookup",{"vendor":58,"product":39},"Microsoft","campaign","2026-09-17T07:09:37.283462+00:00","2026-10-16T12:28:37.018085+00:00",null,{"articles":64},[65,76,87,99],{"slug":66,"title":67,"summary":68,"tags":69,"hero_image_url":74,"story_type":59,"created_at":75},"dr-web-q2-2026-5-72-detections-95-32-unique-threats-max-messenger-phishing-wave","Dr.Web Q2 2026: +5.72% detections, +95.32% unique threats, MAX-messenger phishing wave","Dr.Web's Q2 2026 virus activity review reports a 5.72% increase in total detections and a 95.32% jump in unique threats, with encoder trojans and a MAX-messenger phishing campaign driving the top of the mix.",[70,71,72,73,10],"Dr.Web","Q2 2026","encoder trojans","MAX-messenger","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdr-web-q2-2026-5-72-detections-95-32-unique-threats-max-messenger-phishing-wave.png?v=206efdb9fc","2026-09-20T12:05:24.111918+00:00",{"slug":77,"title":78,"summary":79,"tags":80,"hero_image_url":85,"story_type":59,"created_at":86},"lapsus-phishing-campaign-targets-korean-and-global-financial-sector","LAPSUS$ Phishing Campaign Targets Korean and Global Financial Sector","AhnLab ASEC's June 2026 threat analysis reveals a multi-stage LAPSUS$ phishing campaign targeting the Korean and global financial sector, using a chain of HTML, JS, EXE, and VBE attachments to deploy an infostealer payload.",[81,10,82,83,84],"LAPSUS$","Korean","financial","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flapsus-phishing-campaign-targets-korean-and-global-financial-sector.png?v=2129e9e17b","2026-09-18T17:07:46.926709+00:00",{"slug":88,"title":89,"summary":90,"tags":91,"hero_image_url":97,"story_type":59,"created_at":98},"apt28-deploys-badpaw-and-meowmeow-malware-duo-against-ukraine","APT28 Deploys BadPaw and MeowMeow Malware Duo Against Ukraine","APT28 (Fancy Bear) is running a new campaign against Ukrainian targets using two new .NET malware components, BadPaw (loader) and MeowMeow (backdoor), delivered through a phishing ZIP that opens an HTA file themed around Ukrainian border-crossing appeals.",[92,93,94,95,96,10],"APT28","Fancy Bear","BadPaw","MeowMeow","Ukraine","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fapt28-deploys-badpaw-and-meowmeow-malware-duo-against-ukraine.png?v=457c9d4fd3","2026-08-26T17:07:17.029451+00:00",{"slug":100,"title":101,"summary":102,"tags":103,"hero_image_url":109,"story_type":110,"created_at":111},"u-bomb-rware-runs-active-leak-site-with-proton-mail-and-brc4-sliver-cobalt-strik","U-Bomb Rware Runs Active Leak Site with Proton Mail and BRC4\u002FSliver\u002FCobalt Strike Lateral Movement","U-Bomb ransomware, active since March 2023, operates a data leak site at a .onion address last visited 2026-04-28, delivers payloads via phishing email, and uses BRC4, Sliver, and Cobalt Strike for lateral movement before encrypting Windows and Linux targets.",[104,105,106,107,10,108],"ransomware","U-Bomb","0xFFF","data-leak-site","BRC4","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fu-bomb-rware-runs-active-leak-site-with-proton-mail-and-brc4-sliver-cobalt-strik.png?v=fb0352777e","ransomware_incident","2026-08-27T17:09:35.394473+00:00"]