Mirage2FA Phishing Platform Lets Hackers Steal Microsoft 365 Session Cookies

A sophisticated phishing-as-a-service (PhaaS) platform called Mirage2FA is allowing hackers to bypass multi-factor authentication (MFA) by enabling Microsoft 365 users to complete their regular login process before covertly stealing authenticated session cookies.

Threat researchers at ANY.RUN discovered that the Adversary-in-the-Middle (AiTM) framework generated thousands of potential compromise events from late 2024 through 2026, with the overwhelming majority resulting in hijacked session cookies rather than isolated password theft.

The phishing engine intercepts and retains the authenticated session cookies alongside captured credentials after Microsoft validates the authentication challenge and issues session tokens.

Threat actors possessing these active session cookies can access user mailboxes, SharePoint repositories, OneDrive documents, and Single Sign-On (SSO) enterprise applications without triggering secondary authentication prompts.