Mir0Auth

Mir0Auth is a phishing kit targeting Microsoft 365 authentication tokens, with activity primarily observed against organizations in the United States. It abuses Microsoft's legitimate device-code authentication process to obtain unauthorized corporate account access without stealing passwords. Attacks begin with phishing emails containing PDF attachments that direct recipients to counterfeit DocuSign pages and then into Microsoft's legitimate device-code authentication flow. Once victims complete authentication, attackers can obtain access tokens that enable access to corporate email and documents.

Mir0Auth uses obfuscated scripts, concealed authentication requests, and disguised network endpoints to request device codes and track authentication sessions. Its account-compromise mechanism relies on victims authorizing attacker-initiated authentication requests rather than submitting passwords to a counterfeit login form.