Manufacturing<\/a>, and Education among the most targeted industries. The operation has generated thousands of compromise events between 2024 and 2026, including stolen session cookies, passwords, and SSO access.<\/p>\n\n\n\nOnce an authenticated Microsoft 365 session is hijacked, attackers may gain access to corporate email, sensitive data, and trusted business accounts, creating a path for impersonation, fraud, and further compromise<\/strong>. Detecting the attack before stolen sessions are reused can help security teams contain account takeover earlier and reduce the potential business impact. <\/p>\n\n\n\nKey Takeaways <\/h2>\n\n\n\n\n- Mirage2FA bypasses conventional MFA to hijack active Microsoft 365 sessions.<\/strong> The PhaaS toolkit uses an Adversary-in-the-Middle (AiTM) flow to capture credentials, 2FA codes, and authenticated session cookies. <\/li>\n<\/ul>\n\n\n\n
\n- Mirage2FA activity was linked to 3,518 unique organization email domains<\/strong>, showing the campaign\u2019s broad reach across US and EU corporate environments.* <\/li>\n<\/ul>\n\n\n\n
\n- The kit shows a high potential compromise rate.<\/strong> Of 9,426 unique targeted email addresses, 4,532 were potentially compromised \u2014 about 48%<\/strong>.* <\/li>\n<\/ul>\n\n\n\n
\n- The US is the main victim market.<\/strong> 2,885 victims, or 63.7% of the total<\/strong>, were located in the United States, while victim activity was recorded across 94 countries. <\/li>\n<\/ul>\n\n\n\n
\n- Session theft is the most common compromise outcome.<\/strong> The dataset contains 9,332 potential compromise events<\/strong>, including 4,561 cookie-theft events, 3,044 password\/2FA events, 1,339 SSO logins, and 388 other outcomes.* <\/li>\n<\/ul>\n\n\n\n
\n- Mirage2FA relies on browser-based delivery rather than binary malware.<\/strong> .htm, .xhtml, and .svg stagers, QR codes, JavaScript obfuscation, and WebSocket-based AiTM activity allow the attack to run largely inside the browser. <\/li>\n<\/ul>\n\n\n\n
\n- Mobile users make up a significant share of successful activity.<\/strong> 33.3% of successful login events came from mobile devices<\/strong>, where phishing pages can be harder to inspect due to limited URL visibility. <\/li>\n<\/ul>\n\n\n\n
\n- Recurring technical patterns remain useful even as infrastructure changes.<\/strong> The \/xls\/*.js loader structure, and LINX* markers provide hunting opportunities beyond individual domains and IP addresses. <\/li>\n<\/ul>\n\n\n\n
Note:<\/strong> All victim, compromise, and campaign-scale figures in this report are approximate estimates based on the available dataset and represent potential impact rather than independently confirmed compromises. <\/p>\n\n\n\n\n\n
\n\n\n
![\"PhantomEnigma](\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Mirage2FA_article-block.png\")
\n<\/div>\n\n
\n
\n\n\n
Read Complete Mirage2FA Research in TI Reports<\/h3>\n\n\n
\nGet a detailed version of the report for SOC and MSSP teams:\n <\/p>