cyber.hendryadrian.com
Threat Research · any.run

Mirage2FA Uses AiTM Phishing to Steal Microsoft 365 Sessions

· Original article ↗

Summary

ANY.RUN researchers detail Mirage2FA, a phishing-as-a-service toolkit that uses browser-based attachments and an AiTM proxy to capture Microsoft 365 credentials and session cookies. Its dataset suggests 63.7% of identified victims were in the US.

Key points

  • Mirage2FA uses fake Microsoft 365 login pages and a real-time AiTM proxy to capture credentials and 2FA codes, then steal authenticated session cookies.
  • Delivery includes .htm, .xhtml, and .svg attachments, QR-code lures, and email distribution; the attack largely runs in the browser rather than using binary malware.
  • Researchers observed obfuscated JavaScript, WebSocket activity, recipient-specific tokens, and recurring /xls/*.js loader paths.
  • The dataset recorded 9,332 potential compromise events, including 4,561 session-cookie theft events. The figures are estimates, not independently confirmed compromises.
  • ANY.RUN telemetry identified 2,885 victims in the US, or 63.7% of identified victims, with activity across 94 countries.
  • The toolkit was observed from 2024 through July 2026 and attributed with high likelihood to the LinX Coders cluster.
  • Recommended defenses include phishing-resistant MFA, behavioral detection of loader and WebSocket patterns, and revoking active sessions and tokens after suspected compromise.

Article Details

Attack Vectors
  • Phishing emails deliver malicious .htm, .xhtml, or .svg attachments, or links to QR-code lures; the article also reports distribution through Amazon SES.
  • Opening an attachment runs a browser-based stager. Obfuscated HTML or SVG JavaScript retrieves Mirage2FA harvesting logic using /xls/<token>.js loader paths.
  • An Adversary-in-the-Middle reverse proxy presents a fake Microsoft 365 login page and relays credentials and one-time 2FA codes to the legitimate service over WebSocket.
  • The toolkit captures authenticated session cookies and sends them, along with credentials, to the operator panel; attackers can reuse the sessions to access Microsoft 365 accounts.
Defensive Notes
  • Block or quarantine .htm, .xhtml, and .svg attachments where possible; detect HTML smuggling, obfuscated JavaScript, suspicious QR-code lures, and browser-executed attachment behavior.
  • Analyze suspicious files in an isolated environment and monitor for /xls/*.js loader requests, Base64-encoded email addresses in DNS labels, and outbound WebSocket connections following loader retrieval.
  • Use phishing-resistant MFA such as FIDO2/WebAuthn or passkeys for high-risk users; consider shorter session lifetimes, token binding, and Continuous Access Evaluation in Microsoft Entra ID.
  • After suspected session theft, revoke active sessions and tokens, review Microsoft 365 mail-forwarding rules and OAuth grants, and investigate activity performed through the compromised identity; a password reset alone may be insufficient.

Indicators of compromise

TypeIndicatorContext
DOMAINadp[.]pslcertlive[.]siteListed by the article as a Mirage2FA phishing domain.
DOMAINans[.]rsxbenefits[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINari[.]vslbertlive[.]infoListed by the article as a Mirage2FA phishing domain.
DOMAINars[.]greebys[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINasvbtech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINavsbtech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINbezdelz[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINbns[.]baseasix[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINbsf[.]allmetreod[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINbverster[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINcementslabconstruction[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINcer[.]septey[.]shopListed by the article as a Mirage2FA phishing domain.
DOMAINcer[.]verpox[.]shopListed by the article as a Mirage2FA phishing domain.
DOMAINcureaveritax[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINcvs[.]pcvgtech[.]onlineListed by the article as a Mirage2FA phishing domain.
DOMAINdezbelz[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINdverster[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINeverster[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINfureaveritax[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINfverster[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINgacorslot7d[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINgalatasaraydanhaberler[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINgectech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINgverster[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINgztev[.]it[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINhpn[.]bandhiem[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINhverster[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINhvr[.]volatilesour[.]storeMirage2FA C2/loader domain identified by ANY.RUN.
DOMAINhynutech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINimplentedgucedirectory[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINintrugementslayerdocuservice[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINiverster[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINjscvbtech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINjureaveritax[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINjverster[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINmettsoll[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINoectech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINoffice[.]avcbtech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINoffice[.]pcvgtech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINpancincorp[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINpavetech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINpectech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINpezbelz[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINpureaveritax[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINpvf[.]schwiessdoors[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINpvs[.]schwiessdoors[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINpxvbtech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINpynutech[.]storeListed as Mirage2FA loader infrastructure and in the article’s phishing-domain list.
DOMAINrfm[.]m3-bulders[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINrmf[.]diversesgs[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINrmf[.]m3-bulders[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINsopbtech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINsvn[.]dpsindustrialsgroup[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINsvr[.]schwiessdoors[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINuser[.]cheacker[.]storeMirage2FA C2/loader domain identified by ANY.RUN.
DOMAINver[.]bandhiem[.]comMirage2FA C2/loader domain identified by ANY.RUN.
DOMAINver[.]verpox[.]shopListed by the article as a Mirage2FA phishing domain.
DOMAINvezbelz[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINvns[.]pigotnet[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINvns[.]tvgsv[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINvns1[.]pigotnet[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINvrf[.]atskinsonel[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINvrf[.]bereetro[.]it[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINvrf[.]gavernova[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINvrf[.]iar0nline[.]comListed by the article as a Mirage2FA phishing domain.
DOMAINwectech[.]storeListed by the article as a Mirage2FA phishing domain.
DOMAINwes[.]cadsta[.]onlineListed by the article as a Mirage2FA phishing domain.
DOMAINzectech[.]storeListed by the article as a Mirage2FA phishing domain.
IPV4139[.]28[.]36[.]38Reported as an operator cross-bot test IP; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4141[.]95[.]59[.]233Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4146[.]70[.]195[.]104Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4181[.]214[.]165[.]173Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4185[.]174[.]100[.]20Reported as an operator cross-bot test IP; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4185[.]174[.]100[.]224C2/loader IP identified by ANY.RUN for Mirage2FA.
IPV4185[.]174[.]100[.]76Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4185[.]199[.]103[.]116Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4185[.]91[.]122[.]32Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4192[.]52[.]166[.]55Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4199[.]233[.]237[.]30Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4209[.]205[.]192[.]6Reported as an operator infrastructure test IP; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV4209[.]205[.]197[.]130Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV483[.]147[.]53[.]130Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV484[.]239[.]25[.]135Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV484[.]239[.]25[.]139Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV484[.]239[.]25[.]144Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV484[.]239[.]27[.]17Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV484[.]239[.]43[.]155Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV498[.]144[.]204[.]109Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV498[.]93[.]13[.]101Reported as a recent operator infrastructure test IP; the article notes the open-source IP/geo data may reflect VPN or spoofing.
IPV498[.]98[.]79[.]35Reported among IPs used for operator infrastructure tests; the article notes the open-source IP/geo data may reflect VPN or spoofing.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe stagers obscure their logic using JavaScript obfuscation, including XOR/Base64/eval and hex-string decoding.T1027.006 · HTML SmugglingHTML smuggling is used in browser-based stagers to decode and execute content.T1071.001 · Web ProtocolsThe article associates reuse of stolen sessions to access Microsoft 365 with this technique.T1105 · Ingress Tool TransferThe stager retrieves remote harvesting logic through Mirage2FA loader paths such as /xls/<token>.js.T1111 · Multi-Factor Authentication InterceptionThe phishing flow captures the victim’s one-time 2FA code.T1204.002 · Malicious FileOpening a malicious attachment causes the browser to execute its embedded stager.T1539 · Steal Web Session CookieMirage2FA steals authenticated session cookies and stores them as Base64-encoded .txt dumps for reuse.T1557 · Adversary-in-the-MiddleAn AiTM reverse proxy relays the victim’s authentication to Microsoft 365 in real time.T1566.001 · Spearphishing AttachmentPhishing emails deliver malicious .htm, .xhtml, or .svg attachments.T1566.002 · Spearphishing LinkPhishing messages direct victims to links, including QR-code links.

People

raptur3Listed as an ANY.RUN Network Analyst and contributor to the article.ShiFuListed as an ANY.RUN Threat Intelligence Analyst and contributor to the article.

Threat Actors

LinX CodersIdentified by the article as the Mirage2FA brand/operator; the attribution is based on observed LINX markers, bot names, and related infrastructure.

Vendors

AmazonEmail attachments (.htm/.xhtml/.svg), links; distribution including Amazon SES MicrosoftHomeMalware AnalysisMirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US

Products

Microsoft 365HomeMalware AnalysisMirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the USMicrosoft Entra IDShorter session lifetimes, token binding, and Continuous Access Evaluation in Microsoft Entra ID can also reduce the window in which a stolen authenticated session remains useful.

Tools

Mirage2FAMirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle (AiTM) attacks.

Countries

CanadaVictim activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other countries.IndiaVictim activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other countries.Saudi ArabiaVictim activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other countries.SingaporeVictim activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other countries.South AfricaVictim activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other countries.United KingdomVictim activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other countries.United States2,885 victims, or 63.7% of the total, were located in the United States, while victim activity was recorded across 94 countries.

Industries

ConsultingConsulting EducationANY.RUN research shows that 63.7% of identified victims are in the US, with Technologies, Manufacturing, and Education among the most targeted industries.financeFraud and impersonation exposure: Compromised accounts can be used to target employees, customers, suppliers, or finance teams.HealthHealth ManufacturingANY.RUN research shows that 63.7% of identified victims are in the US, with Technologies, Manufacturing, and Education among the most targeted industries.MSSPsTechnology, MSSPs, and Manufacturing Face the Highest ExposureTechnologyMirage2FA phishing targets US companies in technology and manufacturingTelecommunicationsTelecommunications 

Related Articles