Mirage2FA Kit Steals Microsoft 365 Session Cookies for Full Account Takeover

A phishing-as-a-service kit called Mirage2FA has been discovered by researchers at ANY.RUN. This kit steals Microsoft 365 session cookies, allowing attackers to bypass two-factor authentication and gain full access to compromised accounts.

The attack chain starts with a phishing email that often appears as an HR or benefits notice. When the victim opens the attachment, it runs a stager in the browser that reaches out to a remote loader using a JavaScript path. The loader then sends the victim's credentials and one-time code to Microsoft over a WebSocket channel.

The researchers have tied the campaign to 9,332 discrete compromise events across 94 countries, with 4,532 potentially compromised accounts and 2,885 victims in the US alone. Technology firms and manufacturing companies are among the hardest-hit sectors.