Mirage2FA Phishing Kit Slipped Past Microsoft 365 Logins at 4,500 Firms

Key points

• Mirage2FA, a rented phishing kit, has hit around 4,500 companies in the US and Europe between 2024 and 2026, according to sandbox firm ANY.RUN.
• The kit targets Microsoft 365 accounts and is built to defeat two-factor authentication, the second code most workers enter after their password.
• ANY.RUN researchers found that 48% of email addresses aimed at by the campaign were potentially broken into.
• Most victim organisations are based in the United States.
• The attack works by sitting invisibly between the user and the real Microsoft login page, capturing both password and session token.

A phishing service called Mirage2FA has spent almost two years quietly picking apart Microsoft 365 logins at thousands of companies, and nearly half of the people it aimed at appear to have been caught.

The figures come from ANY.RUN, a malware sandbox company that watched the campaign run from 2024 into 2026. Their tally: about 4,500 affected organisations, mostly in the United States, with a smaller cluster in Europe. The finding was picked up more widely by The Hacker News.

What is Mirage2FA, in plain English?

Mirage2FA is a phishing-as-a-service kit, meaning criminals rent it like software rather than build their own. It sends fake Microsoft 365 login pages to staff at target companies. When someone types in their password and their two-factor code, the kit passes it all through to the real Microsoft site and steals the resulting session in the middle.

That middle step is the important one. Old-school phishing just grabbed passwords. Kits like Mirage2FA grab the session cookie, the small file your browser holds after you log in, which tells Microsoft you are already signed in. With that cookie, the attacker walks straight into the mailbox without needing to enter a code themselves.

In protocol terms this is an adversary-in-the-middle attack against the OAuth 2.0 and OpenID Connect flows Microsoft 365 uses. In human terms: the padlock in the browser is genuine, the login page looks correct, and the second code you were told would protect you gets forwarded to the crooks in real time.

Who got hit?

ANY.RUN puts the affected count at roughly 4,500 companies, with US firms taking the brunt. The researchers say 48% of the email addresses the campaign aimed at were potentially broken into. That is not a rounding error. It is close to a coin flip on every inbox the crooks pointed at.

The kit is sold commercially, so the 4,500 number reflects many different criminal customers running their own smaller campaigns off the same shared plumbing.

Would MFA have helped?

Honestly, not much. Standard two-factor authentication, the kind that sends a code by text message or an authenticator app, is exactly what Mirage2FA is built to defeat. The user enters the code, the kit relays it, and the attacker gets a valid session.

What does help is phishing-resistant MFA. That means passkeys or hardware security keys that use the FIDO2 standard, which ties the login to the real Microsoft web address at the cryptographic level. A fake page cannot request the key, because the key checks the domain itself. Microsoft has been pushing customers toward this for exactly this reason.

Conditional access rules also matter. Blocking logins from unusual countries, forcing device compliance, and shortening session lifetimes all reduce how much a stolen cookie is worth.

What should ordinary staff do?

If your employer uses Microsoft 365 and you clicked a login link from an email in the last two years, it is worth telling IT. Ask them to check your sign-in history for logins from places you have never been, and to revoke any active sessions on your account. Changing your password alone will not kick an attacker out if they already hold your session cookie.

For everyone else, the practical rule is small and boring. Do not log in to work accounts from links in emails. Go to the site the way you normally do.