What Mirage2FA is
Mirage2FA is an active phishing-as-a-service toolkit aimed at Microsoft 365 credentials and sessions. It uses an adversary-in-the-middle (AiTM) relay to capture login credentials, 2FA codes and session cookies, which lets an attacker reuse a session even after the user has completed MFA.
In research published on 18 August 2026, ANY.RUN attributes the kit to a developer it calls LinX Coders, based on placeholder strings such as LINXCODERSEMAIL, bot names and a "LinXcoded" channel.
The numbers
ANY.RUN's figures come from 1,249 Mirage2FA sandbox sessions observed between September 2024 and July 2026. ANY.RUN describes them as approximate and they have not been independently confirmed.
| Measure | Count |
|---|---|
| Unique targeted email addresses | 9,426 |
| Potentially compromised email addresses | 4,532 (about 48% of those targeted) |
| Organisation email domains | 3,518 |
| Potential compromise events | 9,332 |
| of which session cookie theft | 4,561 |
| of which password/2FA compromise | 3,044 |
| of which SSO login | 1,339 |
| of which other | 388 |
These are potential compromises seen in sandbox data, not confirmed account takeovers. Sandbox activity rose steadily from March to July 2026.
Who was targeted
Activity spanned 94 countries. The United States accounted for 63.7% of potentially compromised addresses (2,885), followed by India (5.1%), Singapore (4.1%), the UK (1.7%), Canada (1.7%), Saudi Arabia (1.4%) and South Africa (1.0%); 12.7% could not be placed.
By industry, the largest shares were Technology (19.2%), Manufacturing (11.1%) and Education (9.9%), followed by Consulting (8.3%), Telecommunications (6.6%), Health (5.4%) and Finance (3.1%). A third of successful login events came from mobile devices.
How the kit works
Delivery is browser-based, with no binary malware observed. ANY.RUN saw HTML (629 samples), XHTML (198) and SVG (187) attachments, QR-code lures, distribution through Amazon SES, and HR and 401(k) themes. The pages use JavaScript obfuscation (XOR, Base64, eval, hex decoding and obfuscator.io-style wrappers), IP and browser fingerprinting, and a WebSocket-based AiTM relay.
Loaders follow a recurring pattern, https://<host>/<3-letter-code>/xls/<token>.js, with /api/xls/a1p2i.js as the canonical path. The kit also carries LINX placeholder markers such as LINXEMAIL, LINXB64EMAIL and #LINXRANDSTRING.
What to do
ANY.RUN recommends revoking active sessions and tokens for affected users, investigating activity from potentially compromised identities, and using phishing-resistant MFA for high-risk accounts. The loader path pattern and LINX markers are useful hunting leads in web proxy and email gateway logs.
Key points
- Mirage2FA is a phishing-as-a-service kit that uses an AiTM relay to steal Microsoft 365 credentials, 2FA codes and session cookies.
- ANY.RUN counts 4,532 potentially compromised addresses out of 9,426 targeted, and 9,332 potential compromise events, from September 2024 to July 2026.
- 63.7% of potentially compromised addresses are in the US; activity spans 94 countries.
- Delivery uses HTML, XHTML and SVG attachments and QR codes, with no binary malware.
- ANY.RUN attributes the kit to a developer it calls LinX Coders.