They Let You Finish Your Real MFA. That Was the Point. Mirage2FA Took 4,532 Sessions From 9,426 Attempts, and the Phishing Mail Came From a Company You Actually Do Business With.
- Patrick Duggan
- 1 day ago
- 5 min read
Nine thousand four hundred and twenty-six email addresses targeted. Four thousand five hundred and thirty-two potentially compromised.
That is a 48 percent success rate against organisations that, overwhelmingly, had multi-factor authentication switched on. Roughly one in two. If you have ever sat in a meeting where someone said "we rolled out MFA, we're covered on phishing," this is the number that belongs on the next slide.
The platform is Mirage2FA, also tracked as LinXcoded — a commercial phishing-as-a-service operation that has been running from 2024 through 2026, with 63.7 percent of identified victims in the United States, concentrated in technology, manufacturing and education.
It does not beat MFA. It waits politely for you to finish.
The mechanism is adversary-in-the-middle, and the elegance is in what it declines to do.
It does not crack anything. It does not phish a one-time code and race you to the login box. It sits between you and Microsoft's genuine authentication endpoint and relays. You see the real login page, because it is the real login page, proxied. You type your real password. You get your real MFA prompt — push notification, authenticator app, hardware token, whatever you deployed — and you approve it, correctly, because everything you are looking at is legitimate.
Microsoft, satisfied, issues a session cookie.
Mirage2FA takes the cookie.
From that moment the attacker is not impersonating an authenticated user. They are the authenticated user, holding the same token your browser holds, with access to mail, files, and everything hanging off SSO. Nothing they do afterwards trips an authentication control, because the authentication already succeeded — genuinely, with your participation, exactly as designed.
Why the hit rate is one in two
A 48 percent conversion on phishing is absurd. Ordinary campaigns live in the low single digits. The reason this one is different has nothing to do with the landing page and everything to do with the envelope.
The lures are sent from compromised, authenticated Microsoft 365 enterprise tenants. Real companies. Real domains. Valid SPF, valid DKIM, correct DMARC alignment, clean sending reputation, often an existing thread with the recipient.
Every layer of defence built on is this sender bad returns no, because the sender is not bad. The sender is a manufacturing firm in Ohio that got hit last month and does not know it yet.
And that is the part that makes this self-sustaining: every victim becomes the next campaign's sending infrastructure. The operation does not need to buy domains, age them, warm them up, or evade a blocklist, because it never uses infrastructure of its own for the part that gets inspected. There is no bad domain to list. Static domain blocklists — including ours, and I will say that plainly — have nothing to bite on here.
The third kit, and what the set of three tells you
We pulled apart two other Microsoft 365 kits in July, and lining all three up is more useful than any one of them alone:
OmegaLord puts up a fake PDF-reader login, harvests the credential and the phone number, then intercepts the SMS code or MFA prompt in real time. It attacks the code.
Jalisco abuses the OAuth 2.0 Device Authorization Grant and phishes no credentials at all — the victim authenticates on Microsoft's own site, with real MFA, and unknowingly authorises the attacker's device. It attacks the grant.
Mirage2FA relays the whole login and steals the cookie at the end. It attacks the session.
Three kits, three entirely different mechanisms, zero cryptography broken between them. Nobody is attacking MFA. Everybody is attacking the seam where MFA hands off to something else and stops paying attention.
Because that is what multi-factor authentication actually is: a control that proves who was standing at the door, once. The session token is what the building trusts afterwards, for hours, and no kit above has to defeat the first thing in order to own the second. We have spent a decade telling people MFA stops phishing. What it stops is credential replay. Those are not the same sentence, and the gap between them is a commercial product with a 48 percent close rate.
What actually helps
None of this is exotic to defend, it is just less satisfying than turning MFA on:
Bind the token to the device. Phishing-resistant credentials — passkeys, FIDO2 security keys, certificate-based auth — break the relay because the authentication is cryptographically tied to the origin. A proxy in the middle cannot pass that through. This is the one that actually kills the technique rather than raising its cost.
Make a stolen cookie less useful. Conditional access on device compliance and location, continuous access evaluation, and session lifetimes measured in hours rather than weeks.
Revoke sessions, not just passwords. This is the single most common incident-response miss we see. Someone gets phished, the helpdesk resets the password, everybody relaxes, and the attacker's stolen token keeps working because a password reset does not invalidate an issued session unless you explicitly make it. If you take one operational habit from this post, take that one.
Watch for the impossible session. A token in use from a location or device that never authenticated is the signal, and it lives in your sign-in logs, not your mail gateway.
Sources
Mirage2FA / LinXcoded phishing-as-a-service platform, adversary-in-the-middle attacks against Microsoft 365, active 2024–2026. Victim statistics — 9,426 unique targeted addresses, 4,532 potentially compromised, 63.7 percent United States, concentrated in technology, manufacturing and education — from ANY.RUN research, reported by The Hacker News on 25 August 2026.
The OmegaLord and Jalisco comparisons are from our own coverage of 14 July 2026.
Capped at 95 percent: the victim numbers are ANY.RUN's and we have not independently verified them; "potentially compromised" is their phrasing and it is doing real work, since a targeted address that entered credentials is not automatically a completed session theft. We hold no first-party indicators for this campaign — no Mirage2FA-attributed records in our feed, and no infrastructure to publish, which in this case is partly the point: the infrastructure is other people's tenants.
If your incident-response runbook says "reset the password" and does not say "revoke the sessions," that is a one-line edit tonight and it is worth more than anything else in this post. Rate this post below.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=they-let-you-finish-your-real-mfa-that-was-the-point-mirage2fa-took-4-532-sessions-from-9-426-atte
Comments