A phishing-as-a-service toolkit tracked as Mirage2FA has quietly become one of the more effective threats aimed at Microsoft 365 tenants, according to new research from analysts at ANY.RUN. The kit does not bother trying to guess passwords or grind through multi-factor prompts. Instead, it sits in the middle of a real login and steals the session itself, which means a correctly entered password and a completed MFA challenge do nothing to stop it.

A campaign measured in the thousands

Researchers ShiFu and raptur3 traced activity back to September 2024, but the operation has accelerated sharply through the middle of 2026. Their analysis logged roughly 9,300 individual compromise events spread across 94 countries, touching more than 3,500 organizations and over 9,400 distinct email addresses. Nearly half of the people targeted ended up compromised in some form — an unusually high hit rate for a phishing campaign at this scale. The United States absorbed the bulk of the damage, accounting for close to two-thirds of victims, with India, Singapore, the UK, and Canada rounding out the next tier. Technology, manufacturing, education, and consulting firms were hit hardest, and managed security service providers appear to have been deliberately targeted as well, likely for the downstream access they hold into client networks.

How the theft actually works

Mirage2FA is built around an adversary-in-the-middle (AiTM) reverse proxy. Victims receive an email — often disguised as an HR notice or a 401(k) benefits update, in some cases sent through legitimate Amazon SES infrastructure to slip past spam filters — carrying an HTML, XHTML, or SVG attachment. Some variants use QR codes to push the victim toward a mobile browser instead. Opening the attachment routes the target to a convincing fake Microsoft sign-in page. Whatever the victim types, including a one-time MFA code, is relayed live to the real Microsoft login in the background, and the resulting authenticated session cookie is captured on the way back.

That cookie is the real prize. With it, an attacker can open the victim’s mailbox or SharePoint files without ever needing the password again, and without triggering another MFA prompt, at least until the session token is revoked or expires. Session cookie theft accounted for the largest single category of outcomes in the dataset, ahead of straightforward password-and-code capture, and about a third of successful compromises happened when victims were using a mobile device.

Layers of obfuscation

The samples researchers pulled apart showed heavy use of obfuscation: base64 encoding paired with a fixed XOR key, hex-encoded decoders, and commercial-grade JavaScript packers. Loader scripts followed a consistent URL pattern pulling from domains such as cheacker[.]store and bandhiem[.]com, routed through infrastructure tied to a single autonomous system. Internal build strings evolved over time — from an early “LINXCODERSEMAIL” marker to later “LINXB64EMAIL” variants — which let analysts stitch together a timeline of the kit’s development.

Who’s behind it

Attribution work points to a group operating under the name LinX Coders, advertised through Telegram channels selling access to “LinX Sender” and cookie-theft attachment builders. Overlapping subnets between early testing infrastructure and live campaign servers, plus a shared bot identifier, let researchers link 2024-era test runs to the current operation.

What defenders should do

Because the attack defeats traditional MFA, the standard advice to “just enable two-factor” falls short here. Security teams are being urged to:

• Block or quarantine inbound .htm, .xhtml, and .svg attachments at the email gateway, and add detection rules for obfuscated JavaScript and HTML smuggling.
• Move high-risk accounts — administrators, finance, executives — to phishing-resistant MFA such as FIDO2 hardware keys or passkeys, which AiTM proxies cannot relay.
• Shorten session token lifetimes and enable continuous access evaluation in Microsoft Entra ID so stolen cookies expire faster.
• Treat any suspected session theft as a full identity compromise rather than a simple password reset: revoke active sessions and tokens, and audit mailbox rules, OAuth grants, and any actions taken under the compromised identity.

With the kit still actively developed and sold as a service, organizations that rely solely on password-plus-MFA as their authentication ceiling should expect to see Mirage2FA-style attacks again.