Campaign17 Sept 2026·2 sources
Mirage2FA Phishing Kit Linked to 4,500 Potentially Compromised Microsoft 365 Accounts
ANY.RUN has linked the Mirage2FA phishing-as-a-service kit, attributed to a developer called LinX Coders, to 4,532 potentially compromised email addresses across 94 countries. The kit uses an adversary-in-the-middle relay to capture Microsoft 365 credentials, 2FA codes and session cookies.
phishingm365aitm+2
