A new Phishing-as-a-Service platform called Mirage2FA is providing cybercriminals with the ability to bypass multi-factor authentication (MFA) in Microsoft 365 accounts. This sophisticated tool allows attackers to intercept authenticated sessions after users complete their login process, posing significant threats to enterprise security.
How Mirage2FA Compromises Security
Security researchers from ANY.RUN have uncovered how the Adversary-in-the-Middle (AiTM) framework employed by Mirage2FA leads to massive session cookie theft rather than merely targeting passwords. This method has been in effect since late 2024, resulting in a substantial number of compromised accounts.
The tool operates by positioning itself between users and legitimate authentication endpoints. When users enter their credentials and one-time passcodes into a fake login portal, the data is immediately relayed to the actual Microsoft 365 service. Once authentication is confirmed, the tool intercepts the session tokens, allowing unauthorized access.
Impact and Reach of Session Hijacking
Armed with intercepted session cookies, attackers can access various Microsoft 365 services without triggering additional authentication prompts. The group behind this operation, identified as LinX Coders, uses particular configurations and telemetry channels to manage the stolen sessions.
ANY.RUN’s analysis shows a vast exposure across enterprises, affecting 3,518 email domains and 9,426 accounts, with the United States being the most impacted. The campaign also hit countries like India, Singapore, and the UK, with the technology sector being the primary target.
Mitigation and Future Outlook
The infection chain operates entirely in the browser, often using obfuscated HTML and SVG attachments in phishing emails. Security experts stress the importance of focusing on structural attack patterns rather than domain names. Immediate actions include invalidating active sessions, revisiting OAuth permissions, and implementing hardware security solutions like FIDO2 keys.
Organizations must remain vigilant and proactive in addressing these threats. Traditional password resets are inadequate; comprehensive strategies must be adopted to ensure session security and prevent unauthorized access.
As the cybercrime landscape evolves, integrating advanced threat detection and investigation tools, such as ANY.RUN, is crucial for strengthening security operations centers (SOCs) and combating phishing campaigns effectively.
