other

Mirage2FA

Commercial phishing-as-a-service toolkit and associated campaign reported by ANY.RUN as targeting Microsoft 365 accounts from 2024 to 2026, abusing legitimate login flows and bypassing two-factor authentication via session-cookie theft.

Known aliases

Mirage2FA campaign
Mirage2FA kit

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 distinct publisher

Mirage2FA: 4,532 domains later, "we have MFA" is not an answer to the auditor

ANY.RUN says a commercial phishing kit ran against Microsoft 365 login flows from 2024 to 2026, harvesting session cookies. The control that matters now is what happens to the token.

Publishers:thehackernews.com

Reality

Evidence30
Adoption38
Hype gap+40
Incentives85