A new phishing‐as‐a‐service (PhaaS) operation dubbed Mirage2FA is exploiting a clever bypass of multi‐factor authentication (MFA) to seize Microsoft 365 sessions. In attacks observed across 94 countries, more than 3,500 organizations have been targeted and over 4,500 Microsoft 365 accounts put at risk. Nearly half of those hit may have been compromised. This is a significant threat shift in Microsoft 365 security.
How Mirage2FA Works: Session Stealing, Not Malware
Unlike malware campaigns, Mirage2FA delivers phishing lures through .htm, .xhtml, or .svg attachments – occasionally via QR codes – that redirect users to fake Microsoft login pages. The attack proceeds through a reverse-proxy setup that captures the user’s credentials and 2FA code, relays them to Microsoft in real time, then snatches the authenticated session cookie. With that cookie, attackers can access the account and bypass MFA indefinitely, without needing credentials again.
Once stolen, session cookies are encoded using Base64 and stored on operator panels, ready to be played back to Microsoft 365 or any services tied to single sign-on (SSO). That makes password resets ineffectual: the attackers still hold valid sessions. Mobile users are particularly vulnerable, accounting for one in three successful compromises, possibly because mobile browsers give fewer visual cues of deception.
Scale, Evolution, and Industries Affected
Research by threat intelligence experts shows Mirage2FA reached at least 9,400 unique emails, with about 48% showing signs of compromise. The United States accounts for over 60% of victims; other affected countries include India, Singapore, the U.K., and Canada.
Industries bearing the brunt include technology (19.2%), manufacturing (11.1%), education, consulting, telecom, healthcare, and finance. Managed service providers are also being targeted heavily, posing multiplier risks because one compromised MSSP can expose many downstream customers.
First spotted in September 2024, Mirage2FA’s activity picked up pace sharply in 2026. Analysis of sandbox sessions reveals steady growth in detections—July alone saw hundreds of recorded incidents. Code complexity has increased over time, adding greater obfuscation and rotating infrastructure as the campaign evolves.
Indicators, Countermeasures, and What to Defend Against
The attack chain begins via phishing emails, often masquerading as HR or benefits notifications, delivered through Amazon SES. Victims open attachments or QR codes that load stagers in their browser. These stagers fetch harvesting logic from URLs with paths like /xls/
Six stager types have been observed: various .htm and XHTML loader stubs, obfuscated loaders using XOR and hex, and SVG scripts that redirect victims immediately. These all serve the same goal.
Defenders are urged to block or quarantine .htm/.xhtml/.svg attachments at email gateways, detect obfuscated JavaScript or HTML smuggling techniques, and be wary of QR-code lures and SES-based email delivery. For high-risk personnel—admins, executives, finance—adopt phishing-resistant MFA like FIDO2 or passkeys, enforce shorter session timeouts, use token binding, and enable Continuous Access Evaluation (CAE) in Microsoft Entra ID.
Forensics should treat these incidents as identity breaches rather than simple credential leaks. Revoke all active sessions and tokens, audit forwarding rules and OAuth authorizations, and trace every action taken under compromised accounts. Indicators of compromise include specific loader requests, Base64-encoded email addresses in domains, eval() calls after XOR+Base64 decoding, irregular WebSocket traffic, and known LINX placeholders.
Mirage2FA demonstrates how attackers are sidestepping traditional MFA protections by hijacking sessions rather than passwords. The shift underscores that strong MFA alone is no longer sufficient against advanced phishing-as-a-service threats. What to watch: adoption of phishing-resistant MFA, tighter session management policies, and better email attachment filtering will be decisive in limiting future risk.
