Mirage2FA Platform Enables Session Hijacking Post-MFA for Microsoft 365
A new Phishing-as-a-Service platform, Mirage2FA, is allowing attackers to steal Microsoft 365 session cookies after users complete multi-factor authentication, bypassing traditional security measures.
A sophisticated Phishing-as-a-Service (PhaaS) platform known as Mirage2FA is enabling threat actors to bypass multi-factor authentication (MFA) by allowing Microsoft 365 users to complete their regular login process before covertly stealing the authenticated session. Threat researchers have discovered that this Adversary-in-the-Middle (AiTM) framework has generated thousands of potential compromise events, with the overwhelming majority resulting in hijacked session cookies rather than isolated password theft.
Mirage2FA operates by positioning itself directly between the user and legitimate authentication endpoints. When an employee enters their corporate credentials and one-time passcode into a crafted replica login portal, the toolkit immediately proxies that data to the genuine Microsoft 365 service over a persistent WebSocket channel. Once Microsoft validates the authentication challenge and issues session tokens, the phishing engine intercepts and retains the authenticated session cookies alongside captured credentials.
Threat actors possessing these active session cookies can access user mailboxes, SharePoint repositories, OneDrive documents, and Single Sign-On (SSO) enterprise applications without triggering secondary authentication prompts. This technique effectively circumvents MFA by targeting the session token itself, which is generated after successful MFA validation.
The operation has been attributed to a threat group known as LinX Coders, identified by recurring indicators such as specific configuration tags and backend telemetry channels. The emergence of such automated session-hijacking tools reflects the rapid expansion of modern phishing-as-a-service kits across the cybercrime underground.
Telemetry collected from sandbox analysis reveals widespread enterprise exposure, encompassing thousands of unique email domains and targeted accounts globally. United States organizations have borne the brunt of the campaign, representing a significant majority of identified victims, though infections have also been identified across numerous other countries.
The technology sector represented the largest target share, followed by manufacturing and education, with healthcare, consulting, and finance also experiencing significant impact. Of the logged compromise events, session-cookie theft was the leading method, highlighting the effectiveness of this AiTM approach.
The infection chain operates entirely within the victim's browser without deploying binary malware. Phishing lures arrive as various attachment types or embedded links disguised as corporate communications. Once opened, the file runs a stager that retrieves harvesting logic from remote script paths.
Security operations teams must focus threat hunting on structural patterns rather than rotating domain names, looking for specific web request patterns and outbound WebSockets. Implementing proactive measures for stopping phishing campaigns remains critical. Standard password resets are insufficient to remediate active session hijacking; security teams must immediately invalidate all active sessions and refresh tokens, audit tenant OAuth permissions, enforce FIDO2 hardware security keys, and enable Continuous Access Evaluation (CAE) within Microsoft Entra ID to neutralize stolen session cookies.