EdgeProtect
Threat News
Latest cyber threat intelligence, breaches and exploitation
2 matching stories
MFA BypassMirage2FA Phishing Kit Linked to 4,500 Potentially Compromised Microsoft 365 Accounts
ANY.RUN has linked the Mirage2FA phishing-as-a-service kit, attributed to a developer called LinX Coders, to 4,532 potentially compromised email addresses across 94 countries. The kit uses an adversary-in-the-middle relay to capture Microsoft 365 credentials, 2FA codes and session cookies.
Cato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA
Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.
