Mirage2FA Phishing Tool Compromises Over 4,000 US Microsoft 365 Sessions

Mirage2FA is an active phishing-as-a-service toolkit that has compromised over 4,000 US companies' Microsoft 365 sessions. The tool, built to steal credentials and authenticated sessions through Adversary-in-the-Middle (AiTM) attacks, targets technology and manufacturing industries.

According to ANY.RUN research, the operation has generated thousands of compromise events between 2024 and 2026. Once an authenticated Microsoft 365 session is hijacked, attackers may gain access to corporate email, sensitive data, and trusted business accounts, creating a path for impersonation, fraud, and further compromise.

The toolkit uses an Adversary-in-the-Middle (AiTM) flow to capture credentials, 2FA codes, and authenticated session cookies. The US is the main victim market, with 63.7% of identified victims located in the United States. Session theft is the most common compromise outcome, accounting for over half of all recorded events.