A sophisticated Phishing-as-a-Service (PhaaS) platform marketed as Mirage2FA is enabling threat actors to bypass multi-factor authentication (MFA) by allowing Microsoft 365 users to complete their regular login process before covertly stealing the authenticated session.
Threat researchers at ANY.RUN discovered that the Adversary-in-the-Middle (AiTM) framework generated thousands of potential compromise events from late 2024 through 2026, with the overwhelming majority resulting in hijacked session cookies rather than isolated password theft.
Hackers Steal Microsoft 365 Sessions After MFA
Instead of attempting to break MFA algorithms directly, Mirage2FA positions itself directly between the user and legitimate authentication endpoints.
When an employee enters their corporate credentials and one-time passcode into a crafted replica login portal, the toolkit immediately proxies that data to the genuine Microsoft 365 service over a persistent WebSocket channel.
Once Microsoft validates the authentication challenge and issues session tokens, the phishing engine intercepts and retains the authenticated session cookies alongside captured credentials.
Threat actors possessing these active session cookies can access user mailboxes, SharePoint repositories, OneDrive documents, and Single Sign-On (SSO) enterprise applications without triggering secondary authentication prompts.
ANY.RUN attributes the operation to a threat group known as LinX Coders, identifying recurring indicators such as LINXCODERSEMAIL configuration tags, backend telemetry channels like linxlogsss, and dedicated developer hubs.
The emergence of such automated session-hijacking tools reflects the rapid expansion of modern phishing-as-a-service kits across the cybercrime underground.
Telemetry collected from sandbox analysis reveals widespread enterprise exposure, encompassing 3,518 unique email domains and 9,426 targeted accounts, with approximately 4,532 addresses exhibiting clear indicators of potential compromise.
United States organizations bore the brunt of the campaign, representing 63.7 percent of identified victims, while infections were also identified across India, Singapore, the United Kingdom, Canada, Saudi Arabia, and South Africa.
The technology sector represented the largest target share at 19.2 percent, followed by manufacturing at 11.1 percent and education at 9.9 percent, with healthcare, consulting, and finance filling out the remaining volume.
Out of 9,332 logged compromise events, session-cookie theft led with 4,561 instances across 2,541 unique victims. Mobile endpoints accounted for a third of successful logins, highlighting the advantage attackers gain when victims review obscured URLs on smaller mobile displays.
The commoditization of these tokens mirrors high-volume sales across stolen credential markets worldwide.
| Campaign Parameter | Technical Details | Operational Impact |
| Toolkit Name | Mirage2FA (Attributed to LinX Coders) | Real-time AiTM session interception |
| Primary Target Vector | Microsoft 365 & Entra ID SSO Workloads | Direct session hijacking and mailbox access |
| Documented Reach | 9,426 Targeted Accounts across 94 Countries | 4,532 Potential compromises (63.7% US) |
| Delivery Payloads | Obfuscated HTML, XHTML, and SVG Attachments | Script-based staging and WebSocket C2 |
| C2 Infrastructure | AS-Colocrossing (185.174.100.224) |
Persistent endpoints (/api/xls/a1p2i.js) |
The infection chain operates entirely within the victim’s browser without deploying binary malware. Phishing lures arrive as .htm, .xhtml, or .svg attachments and embedded links disguised as corporate HR updates and retirement benefit notices, occasionally routed through Amazon SES.
Once opened, the file runs a stager that leverages per-recipient tokens like LINXB64EMAIL to retrieve harvesting logic from remote script paths such as /xls/<token>.js. Obfuscated HTML decodes Base64 payloads and applies XOR operations using key 0xAD, while SVG lures trigger inline scripts that redirect the browser to the active phishing host.
As detailed in the research analysis , security operations teams must focus threat hunting on structural patterns rather than rotating domain names. With live Threat Intelligence lookups, you can compile reports on malware and phishing attacks
Key indicators include web requests matching /<three-letter-code>/xls/*.js, canonical endpoints such as /api/xls/a1p2i.js, and outbound WebSockets established immediately following script retrieval.
Implementing proactive measures for stopping phishing campaigns remains critical for enterprise security posture. Standard password resets are insufficient to remediate active session hijacking, as existing tokens remain valid until manually terminated.
Security teams must immediately invalidate all active sessions and refresh tokens, audit tenant OAuth permissions, enforce FIDO2 hardware security keys, and enable Continuous Access Evaluation (CAE) within Microsoft Entra ID to neutralize stolen session cookies.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Hackers Let Microsoft 365 Users Complete MFA, Then Steal Logged-In Sessions appeared first on Cyber Security News.