Mirage2FA Hijacks Microsoft 365 Sessions After MFA Completion

ANY.RUN reported that the Mirage2FA phishing-as-a-service platform has been targeting Microsoft 365 and Entra ID users with an adversary-in-the-middle reverse-proxy setup that captures credentials, MFA codes, and authenticated session cookies in real time. The operation, attributed to LinX Coders, has been active since September 2024 and remained operational through July 2026, targeting 9,426 email accounts across 3,518 organizational domains in 94 countries; 4,532 addresses showed indicators of potential compromise, and 63.7% of identified victims were in the United States.

The phishing chain used malicious .htm, .xhtml, and .svg attachments, QR-code links, HTML smuggling, obfuscated JavaScript, and WebSocket relays to legitimate Microsoft services to let users complete MFA before stealing their live sessions. Researchers linked the activity to infrastructure in the 185.174.100.0/24 subnet and to operator markers including LINXCODERSEMAIL, Telegram branding, and bot naming conventions. Because the attackers primarily hijack active sessions rather than just passwords, defenders were urged to revoke active sessions and refresh tokens in addition to resetting credentials and to use the published indicators and ATT&CK mappings for detection and response.