A phishing kit built specifically to beat MFA
Mirage2FA is not a novel technique dreamed up by a single sophisticated actor. It is a packaged, commercially available phishing-as-a-service kit that lowers the skill bar for running attacker-in-the-middle campaigns against Microsoft 365 accounts at scale, and ANY.RUN's research shows the packaging is working exactly as intended. The toolkit abuses legitimate Microsoft login flows, proxying a real authentication session between the victim and Microsoft's own servers while capturing everything that passes through in transit, including the credentials and the session cookie issued once authentication successfully completes on the victim's end.
That last detail is what separates this from ordinary credential phishing that security teams have trained users to spot for years. A stolen password alone is often useless against an account protected by MFA, because the attacker still lacks the second factor needed to complete a fresh login. A stolen session cookie is fundamentally different. It represents a session that has already cleared MFA once, legitimately, so the attacker walks in with a token that says the challenge was already satisfied, no second factor prompt required on replay, no alarm raised on the account.
The numbers behind a 4,500 company campaign
ANY.RUN's analysis puts the scale in concrete terms that are hard to dismiss as a minor or isolated campaign: 4,532 unique organization email domains targeted, 48 percent of targeted addresses showing signs of potential compromise, and more than 9,000 potential compromise events involving cookie or password theft and session hijacking recorded across the tracked infrastructure. The United States accounted for 63.7 percent of observed victims, with meaningful additional activity also logged in India, Singapore, the United Kingdom, Canada, Saudi Arabia, and South Africa, spreading the exposure well beyond any single regulatory jurisdiction.
Technology, manufacturing, and education came up as the most frequently targeted sectors in ANY.RUN's data, a mix that tracks closely with where Microsoft 365 penetration runs highest and where security operations maturity varies widely even within the same industry vertical. A well-resourced technology company and an under-resourced manufacturer running the identical Microsoft 365 tenant configuration face very different odds against a kit purpose built to exploit the gaps between authentication and session management that most default configurations leave open.
Why MFA compliance checkboxes are not the same as protection
As ANY.RUN's findings put it, the campaign shows "how AiTM attacks can exploit gaps in authentication and session management even when two-factor authentication is in place." That sentence should land uncomfortably for any CISO who has told a board or an external auditor that mandatory MFA enforcement closes the account takeover risk category entirely. Enforced MFA closes the credential-theft version of that risk effectively. It does very little against a kit purpose built to steal the session token issued immediately after MFA succeeds, which is precisely the gap Mirage2FA was engineered to exploit.
This is the gap between a compliance answer and an operational one, and it matters because the two get conflated constantly in board reporting. "Is MFA enabled across the organization" is a yes or no question auditors ask and vendors put on a procurement checklist without much nuance attached. "Can a stolen session cookie bypass our MFA entirely once an employee lands on a convincing lookalike page" is the question that actually determines whether a phishing campaign like Mirage2FA succeeds against a given tenant, and it rarely appears anywhere on that same checklist.
The economics of phishing as a service
What makes Mirage2FA worth covering beyond its raw victim numbers is the business model underneath it, which explains why campaigns like it keep multiplying. Phishing-as-a-service platforms package attacker-in-the-middle infrastructure, the proxy logic, the lookalike login pages, the cookie harvesting backend, into a rentable product that lower-skilled operators can license and run against thousands of targets simultaneously with minimal setup effort. The skill and infrastructure investment happens once, at the platform level, then gets amortized across every campaign that subsequently licenses access to it from the kit's operators.
That model is exactly why campaigns operating at this scale keep appearing under different names attached every few months, cycling through fresh branding while the underlying mechanics stay the same. The underlying AiTM technique itself is not new and has been documented in security research for years. What changes with each iteration is the packaging, the evasion updates built in to stay ahead of email security filters, and the target list assembled for that particular run. Enterprises defending against this category of threat are not defending against one campaign in isolation. They are defending against an active rental market that keeps producing fresh, functionally identical variants of the same core attack.
What actually stops session cookie theft
Standard MFA does not stop this attack path once a session cookie has already been captured in transit. What does stop it is technology that ties a session token to the specific device and browser that completed the original authentication, so a stolen cookie replayed from an attacker's separate machine gets rejected outright even with valid credentials attached to the request. Microsoft's own conditional access token protection feature does exactly this for Entra ID sessions, but it requires deliberate configuration on the administrator's part and is not the default state most tenants ship with out of the box.
Phishing-resistant authentication methods, FIDO2 security keys and passkeys bound to hardware on the user's device, close the remaining gap further by removing the phishable credential from the authentication flow entirely rather than merely protecting it in transit. For enterprises that cannot move every user to hardware-bound authentication in the near term, conditional access policies that flag and block impossible travel or unfamiliar device signatures on session reuse give security operations a practical detective control while the harder rollout happens in parallel. Mirage2FA's 4,500 company footprint is a reasonable argument for moving that rollout up the priority list this quarter rather than next.
