[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYR_kDLJf5yuEiYDYjE_fvFhAlcynKMZ3or8DTzfGun8":3,"$fx0ZwrfDGg2hfgqkWwpn14oLmlFZmZU-_Pnl8CD2jPhk":47},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":43,"created_at":44,"updated_at":45,"published_at":46},"mirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm","Mirage2FA Phishing Kit Linked to 4,500 Potentially Compromised Microsoft 365 Accounts","ANY.RUN counts 4,532 potentially compromised email addresses (63.7% in the US) and 9,332 potential compromise events between September 2024 and July 2026.","ANY.RUN has linked the Mirage2FA phishing-as-a-service kit, attributed to a developer called LinX Coders, to 4,532 potentially compromised email addresses across 94 countries. The kit uses an adversary-in-the-middle relay to capture Microsoft 365 credentials, 2FA codes and session cookies.",[10,11,12,13,14],"phishing","m365","aitm","mfa-bypass","us-victims","# Mirage2FA Phishing Kit Linked to 4,500 Potentially Compromised Microsoft 365 Accounts\n\n*ANY.RUN counts 4,532 potentially compromised email addresses (63.7% in the US) and 9,332 potential compromise events between September 2024 and July 2026.*\n\n**Tags:** `phishing` `m365` `aitm` `mfa-bypass` `phaas`\n\n> ANY.RUN has linked the Mirage2FA phishing-as-a-service kit, attributed to a developer called LinX Coders, to 4,532 potentially compromised email addresses across 94 countries. The kit uses an adversary-in-the-middle relay to capture Microsoft 365 credentials, 2FA codes and session cookies.\n\n---\n\n## What Mirage2FA is\n\nMirage2FA is an active phishing-as-a-service toolkit aimed at Microsoft 365 credentials and sessions. It uses an adversary-in-the-middle (AiTM) relay to capture login credentials, 2FA codes and session cookies, which lets an attacker reuse a session even after the user has completed MFA.\n\nIn research published on 18 August 2026, ANY.RUN attributes the kit to a developer it calls **LinX Coders**, based on placeholder strings such as `LINXCODERSEMAIL`, bot names and a \"LinXcoded\" channel.\n\n## The numbers\n\nANY.RUN's figures come from 1,249 Mirage2FA sandbox sessions observed between September 2024 and July 2026. ANY.RUN describes them as approximate and they have not been independently confirmed.\n\n| Measure | Count |\n|---|---|\n| Unique targeted email addresses | 9,426 |\n| Potentially compromised email addresses | 4,532 (about 48% of those targeted) |\n| Organisation email domains | 3,518 |\n| Potential compromise events | 9,332 |\n| of which session cookie theft | 4,561 |\n| of which password\u002F2FA compromise | 3,044 |\n| of which SSO login | 1,339 |\n| of which other | 388 |\n\nThese are potential compromises seen in sandbox data, not confirmed account takeovers. Sandbox activity rose steadily from March to July 2026.\n\n## Who was targeted\n\nActivity spanned 94 countries. The United States accounted for 63.7% of potentially compromised addresses (2,885), followed by India (5.1%), Singapore (4.1%), the UK (1.7%), Canada (1.7%), Saudi Arabia (1.4%) and South Africa (1.0%); 12.7% could not be placed.\n\nBy industry, the largest shares were Technology (19.2%), Manufacturing (11.1%) and Education (9.9%), followed by Consulting (8.3%), Telecommunications (6.6%), Health (5.4%) and Finance (3.1%). A third of successful login events came from mobile devices.\n\n## How the kit works\n\nDelivery is browser-based, with no binary malware observed. ANY.RUN saw HTML (629 samples), XHTML (198) and SVG (187) attachments, QR-code lures, distribution through Amazon SES, and HR and 401(k) themes. The pages use JavaScript obfuscation (XOR, Base64, `eval`, hex decoding and obfuscator.io-style wrappers), IP and browser fingerprinting, and a WebSocket-based AiTM relay.\n\nLoaders follow a recurring pattern, `https:\u002F\u002F\u003Chost>\u002F\u003C3-letter-code>\u002Fxls\u002F\u003Ctoken>.js`, with `\u002Fapi\u002Fxls\u002Fa1p2i.js` as the canonical path. The kit also carries `LINX` placeholder markers such as `LINXEMAIL`, `LINXB64EMAIL` and `#LINXRANDSTRING`.\n\n## What to do\n\nANY.RUN recommends revoking active sessions and tokens for affected users, investigating activity from potentially compromised identities, and using phishing-resistant MFA for high-risk accounts. The loader path pattern and `LINX` markers are useful hunting leads in web proxy and email gateway logs.\n\n## Key points\n\n- Mirage2FA is a phishing-as-a-service kit that uses an AiTM relay to steal Microsoft 365 credentials, 2FA codes and session cookies.\n- ANY.RUN counts 4,532 potentially compromised addresses out of 9,426 targeted, and 9,332 potential compromise events, from September 2024 to July 2026.\n- 63.7% of potentially compromised addresses are in the US; activity spans 94 countries.\n- Delivery uses HTML, XHTML and SVG attachments and QR codes, with no binary malware.\n- ANY.RUN attributes the kit to a developer it calls LinX Coders.\n\n## Further reading & sources\n\n- [Mirage2FA: A Phishing Threat to US Companies with 4K Victims](https:\u002F\u002Fany.run\u002Fcybersecurity-blog\u002Fmirage2fa-phishing-targets-us-companies) (ANY.RUN)\n- [Major Cyber Attacks in August 2026: US & EU Threats](https:\u002F\u002Fany.run\u002Fcybersecurity-blog\u002Fmajor-cyber-attacks-august-2026) (ANY.RUN)\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm.png?v=66142d32cc",{"malware":18,"targets":21,"industries":27,"techniques":32,"technologies":37},[19],{"name":20},"Mirage2FA",[22],{"name":23,"sector":24,"status":25,"geography":26},"Microsoft 365","SaaS","confirmed","US",[28],{"url":29,"name":30,"slug":31},"\u002Findustries\u002Fsoftware-saas","Software & SaaS","software-saas",[33],{"id":34,"url":35,"name":36},"T1557","\u002Fmitre-attack\u002Ftechniques\u002FT1557","Adversary-in-the-Middle",[38,41],{"vendor":39,"product":40},"ANY.RUN","Threat Intelligence Lookup",{"vendor":42,"product":23},"Microsoft","campaign","2026-09-17T07:09:37.283462+00:00","2026-10-16T12:28:37.018085+00:00",null,{"articles":48},[49,62,74,88],{"slug":50,"title":51,"summary":52,"tags":53,"hero_image_url":60,"story_type":43,"created_at":61},"french-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858","French Kubernetes Cluster's Webhook Scan Included n8n CVE-2026-21858 Probes","GreyNoise Labs reported in February 2026 that a Kubernetes scanning cluster on Bucklog SARL's network (AS211590) sent 33,270 sessions at webhook file-upload endpoints between 27 January and 3 February 2026. Forty of those sessions used an n8n-scanner\u002F1.0 user agent aimed at n8n paths associated with CVE-2026-21858.",[54,55,56,57,58,59],"n8n","CVE-2026-21858","webhook","path-traversal","Bucklog","Kubernetes","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrench-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858.png?v=e7ec932bb4","2026-09-14T12:08:30.244241+00:00",{"slug":63,"title":64,"summary":65,"tags":66,"hero_image_url":72,"story_type":43,"created_at":73},"head-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan","Head Mare APT trojanises TrueConf client installers to drop PhantomCore and PhantomGraph backdoors","Kaspersky reports that Head Mare compromised TrueConf video conferencing servers through two flaws that TrueConf fixed on 18 June 2026, then swapped the hosted client installer for a trojanised build delivering the PhantomCore and PhantomGraph backdoors. The campaigns target Russian organisations in six sectors.",[67,68,69,70,71],"Head Mare","TrueConf","PhantomCore","PhantomGraph","APT","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan.png?v=b570cfa52f","2026-08-28T17:23:49.323621+00:00",{"slug":75,"title":76,"summary":77,"tags":78,"hero_image_url":85,"story_type":86,"created_at":87},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[79,80,81,82,83,84],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","threat_actor_activity","2026-10-18T12:09:44.53734+00:00",{"slug":89,"title":90,"summary":91,"tags":92,"hero_image_url":99,"story_type":100,"created_at":101},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[93,94,95,96,97,98],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","CISA KEV","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","vulnerability_disclosure","2026-10-17T12:03:14.799873+00:00"]