Mirage2FA Platform Enables Session Hijacking Post-MFA for Microsoft 365
A new Phishing-as-a-Service platform, Mirage2FA, is allowing attackers to steal Microsoft 365 session cookies after users complete multi-factor authentication, bypassing traditional security measures.
A sophisticated Phishing-as-a-Service (PhaaS) platform known as Mirage2FA is enabling threat actors to bypass multi-factor authentication (MFA) by allowing Microsoft 365 users to complete their regular login process before covertly stealing the authenticated session. Threat researchers have discovered that this Adversary-in-the-Middle (AiTM) framework has generated thousands of potential compromise events, with the overwhelming majority resulting in hijacked session cookies rather than isolated password theft.
Mirage2FA operates by positioning itself directly between the user and legitimate authentication endpoints. When an employee enters their corporate credentials and one-time passcode into a crafted replica login portal, the toolkit immediately proxies that data to the genuine Microsoft 365 service over a persistent WebSocket channel. Once Microsoft validates the authentication challenge and issues session tokens, the phishing engine intercepts and retains the authenticated session cookies alongside captured credentials.
Threat actors possessing these active session cookies can access user mailboxes, SharePoint repositories, OneDrive documents, and Single Sign-On (SSO) enterprise applications without triggering secondary authentication prompts. This technique effectively circumvents MFA by targeting the session token itself, which is generated after successful MFA validation.
The operation has been attributed to a threat group known as LinX Coders, identified by recurring indicators such as specific configuration tags and backend telemetry channels. The emergence of such automated session-hijacking tools reflects the rapid expansion of modern phishing-as-a-service kits across the cybercrime underground.
Telemetry collected from sandbox analysis reveals widespread enterprise exposure, encompassing thousands of unique email domains and targeted accounts globally. United States organizations have borne the brunt of the campaign, representing a significant majority of identified victims, though infections have also been identified across numerous other countries.
The technology sector represented the largest target share, followed by manufacturing and education, with healthcare, consulting, and finance also experiencing significant impact. Of the logged compromise events, session-cookie theft was the leading method, highlighting the effectiveness of this AiTM approach.
The infection chain operates entirely within the victim's browser without deploying binary malware. Phishing lures arrive as various attachment types or embedded links disguised as corporate communications. Once opened, the file runs a stager that retrieves harvesting logic from remote script paths.
Security operations teams must focus threat hunting on structural patterns rather than rotating domain names, looking for specific web request patterns and outbound WebSockets. Implementing proactive measures for stopping phishing campaigns remains critical. Standard password resets are insufficient to remediate active session hijacking; security teams must immediately invalidate all active sessions and refresh tokens, audit tenant OAuth permissions, enforce FIDO2 hardware security keys, and enable Continuous Access Evaluation (CAE) within Microsoft Entra ID to neutralize stolen session cookies.
This new report details a specific instance of an adversary-in-the-middle (AiTM) phishing attack that successfully bypassed Microsoft 365 MFA by capturing an authenticated session cookie. The attackers then replayed this session to impersonate a vendor and redirect payments, demonstrating a sophisticated method of session hijacking that goes beyond simple credential theft.
The Mirage2FA campaign, active from 2024 to 2026, has impacted approximately 4,500 US and EU companies, with research indicating that nearly half of the targeted email addresses were potentially compromised. The campaign leverages a phishing-as-a-service toolkit that exploits legitimate Microsoft 365 login flows to bypass multi-factor authentication by stealing passwords and session cookies. Technology, manufacturing, and education sectors were among the most targeted industries, with the United States accounting for the majority of affected organizations.
The new article provides further details on the scale and technical execution of the Mirage2FA campaign, noting that the phishing-as-a-service toolkit has been linked to the potential compromise of over 4,500 Microsoft 365 accounts across 3,500 organizations. It highlights that the primary attack vector involves HTML attachments leading to a fake login page backed by an adversary-in-the-middle reverse proxy, which steals session cookies after MFA authentication, allowing attackers to hijack sessions without needing credentials. The report also details that US technology and manufacturing sectors are the primary targets, with nearly half of the targeted accounts potentially compromised.
The NovaCookies kit represents a new, more accessible entry point for threat actors seeking to conduct adversary-in-the-middle (AitM) phishing attacks against Microsoft 365 users. Unlike previous iterations or similar tools, NovaCookies is offered as a monthly subscription service for $320, significantly lowering the technical barrier to entry for sophisticated session cookie theft and bypass of multi-factor authentication.