Mirage2FA Phishing Kit Targets Microsoft 365 via HTML Smuggling and MFA-Bypass Simulation
Mirage2FA Phishing Kit Targets Microsoft 365 via HTML (TL-2026-0959), also tracked as Mirage2FA, is a high-severity phishing campaign, first published 2026-06-27. It has no confirmed attribution, affects Microsoft Microsoft 365, maps to 17 MITRE ATT&CK techniques (T1027.006, T1027.013, T1056.003), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0959
- Threat ID
- TL-2026-0959
- Also known as
- Mirage2FA
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-27
- Last reviewed
- 2026-06-27
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- finance, professional services, enterprise, government
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Mirage2FA Phishing Kit Targets Microsoft 365 via HTML
Malware and tooling: Mirage2FA, Mirage2FA phishing kit
Fortra identified Mirage2FA, an active phishing kit that delivers fake Microsoft 365 sign-in pages through short-lived HTML smuggling and heavily obfuscated JavaScript loaders. It gates victims behind a fake CAPTCHA and simulates authenticator-app, number-matching, and SMS MFA challenges to harvest credentials and second factors for Microsoft 365 account takeover.
How Mirage2FA Phishing Kit Targets Microsoft 365 via HTML works
Mirage2FA is a credential-phishing kit reported by Fortra in June 2026 that targets Microsoft 365 accounts. The campaign is delivered through business-themed email lures (secure documents, remittance services, automated billing, and payment requests) carrying an HTML/JavaScript attachment. When opened, the attachment performs HTML smuggling: the malicious payload is assembled and executed entirely in the victim's browser, avoiding a network fetch of the obvious malicious content at delivery time and evading static email/attachment inspection.
The initial HTML payload embeds obfuscated JavaScript to hide its behavior from static analysis. The deobfuscation chain combines Base64 decoding (atob()), a byte-wise XOR using the single-byte key 0xAD, TextDecoder to reconstruct the decoded byte stream into text, and eval() to execute the recovered code. This layered atob() + XOR(0xAD) + TextDecoder + eval() pattern is the kit's most distinctive host/static-analysis fingerprint and is the recommended high-fidelity detection anchor.
After the loader executes, the victim is presented with a Microsoft-branded page styled as a protected/loading business document. A fake CAPTCHA verification screen gates progression and lends legitimacy while filtering automated analysis. The victim is then walked through a counterfeit Microsoft 365 authentication flow that collects email and password, followed by MFA-simulation screens for authenticator-app codes, number-matching approvals, and SMS verification codes (SMS handling was present in the code but not confirmed fully operational). Harvested credentials and second factors enable Microsoft 365 account takeover, granting access to email, files, Teams messages, SharePoint content, and other connected SaaS resources.
Fortra's infrastructure analysis tied the campaign to the domain cheacker[.]store and the second-stage loader subdomain user[.]cheacker[.]store, additional infrastructure at miniapp[.]bereetro[.]it[.]com, the IP address 185.174.100.224, and JavaScript loader resources served from /eor/xls/e1o2r.js and /ulr/xls/u1l2r.js. The cheacker[.]store domain was registered on 2026-03-16, consistent with short-lived, disposable phishing infrastructure rather than a legitimate long-standing service. No CVE is involved; the threat is a social-engineering / AiTM-style credential-harvesting operation.
MITRE ATT&CK techniques used in TL-2026-0959
Defense Evasion
T1027.006 HTML Smuggling; T1027.013 Encrypted/Encoded File; T1140 Deobfuscate/Decode Files or Information
Credential Access
T1056.003 Web Portal Capture; T1111 Multi-Factor Authentication Interception; T1621 Multi-Factor Authentication Request Generation
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
Initial Access
T1078.004 Cloud Accounts; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Collection
T1114.002 Remote Email Collection; T1530 Data from Cloud Storage
Resource Development
T1583 Acquire Infrastructure; T1583.004 Server; T1608.001 Upload Malware
Affected products and versions in Mirage2FA Phishing Kit Targets Microsoft 365 via HTML
- Microsoft — Microsoft 365
Vulnerable versions: all cloud tenants (credential-phishing target) - Microsoft — Entra ID (Azure AD)
Vulnerable versions: accounts protected by phishable MFA (authenticator app, number matching, SMS)
Fixed in: accounts using FIDO2/WebAuthn phishing-resistant MFA
Remediation for Mirage2FA Phishing Kit Targets Microsoft 365 via HTML
Immediate actions
- Block the domains cheacker.store, user.cheacker.store, miniapp.bereetro.it.com and the IP 185.174.100.224 at email gateway, web proxy, and DNS resolver.
- Quarantine inbound email carrying HTML/.htm/.html attachments from untrusted senders, especially with secure-document, remittance, billing, or payment lures.
- Force password reset and revoke active sessions/refresh tokens for any user who interacted with the page (Microsoft Entra ID revoke-sign-in-sessions).
Workarounds
- Strip or sandbox-detonate HTML/JS email attachments before delivery.
- Apply MFA fatigue / number-matching protections and alert on repeated MFA prompt generation.
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2 / WebAuthn passkeys or certificate-based auth) to defeat real-time credential and OTP relay.
- Enable Entra ID Conditional Access with device compliance and managed-network requirements so harvested credentials alone cannot complete sign-in.
- Tune email security to detect HTML smuggling: inspect attachments for atob()/TextDecoder/eval()/byte-wise XOR patterns.
- Enable continuous access evaluation and impossible-travel/anomalous sign-in risk policies.
Weaknesses (CWE) in Mirage2FA Phishing Kit Targets Microsoft 365 via HTML
CWE-1021, CWE-451
Timeline of Mirage2FA Phishing Kit Targets Microsoft 365 via HTML
- Mirage2FA infrastructure staged: loader subdomain user.cheacker.store, additional host miniapp.bereetro.it.com, IP 185.174.100.224, and obfuscated JS loader paths /eor/xls/e1o2r.js and /ulr/xls/u1l2r.js prepared to serve the second-stage payload.
- Phishing domain cheacker.store registered (per Fortra/Help Net Security), consistent with short-lived disposable infrastructure prepared ahead of the campaign.
- Mirage2FA campaign observed active in the wild, delivering HTML-smuggled Microsoft 365 phishing payloads via business-themed email lures (secure documents, remittance, automated billing, payment requests).
- Fortra published technical analysis of the Mirage2FA obfuscated HTML loader and MFA phishing kit, including IOCs and detection guidance.
- Fortra documented the fake-CAPTCHA gate followed by a counterfeit Microsoft 365 sign-in flow simulating authenticator-app codes, number-matching approvals, and SMS verification (SMS present in code but not confirmed fully operational) to harvest credentials and second factors.
- Fortra detailed the kit's distinctive deobfuscation chain — Base64 atob() decode, byte-wise XOR with single-byte key 0xAD, TextDecoder reconstruction, and eval() execution of the recovered loader code.
- Fortra analysis documented the HTML-smuggling initial-access stage: the malicious payload is assembled and executed entirely in the victim's browser from an HTML/JS attachment to evade static email and gateway inspection.
- Help Net Security reported on the Mirage2FA kit, its HTML smuggling delivery, MFA-simulation behavior, and named infrastructure (cheacker.store, user.cheacker.store).
- Threat documented in the Threadlinqs Intelligence Platform with full MITRE ATT&CK mapping, IOC extraction, and detection coverage.
Sources cited for Mirage2FA Phishing Kit Targets Microsoft 365 via HTML
- Mirage2FA: Obfuscated HTML Loader Delivers Microsoft 365 MFA Phishing Kit
- Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials
- MITRE ATT&CK: HTML Smuggling (T1027.006)
- MITRE ATT&CK: Multi-Factor Authentication Request Generation (T1621)
- MITRE ATT&CK: Spearphishing Attachment (T1566.001)
- Microsoft: Defend against phishing with phishing-resistant MFA
- MITRE ATT&CK: Web Portal Capture (T1056.003)
- Microsoft: Revoke user access and sign-in sessions in Entra ID
Threats related to Mirage2FA Phishing Kit Targets Microsoft 365 via HTML
- Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU Organizations, Abusing Microsoft 365 Login Flows
- Zscaler ThreatLabz 2026 Phishing Report: Volume Falls 20% as AI Trades Mass Spam for Targeted, Higher-Conversion Credential & Session-Theft Campaigns
- HTML Phishing Attachment Uses "Comment Stuffing" to Evade AI-Based Detection (SharePoint/Teams Credential Harvesting via Formspark)
- Fake Voicemail SVG Phishing Campaign Bypasses Email Filters via MIME Spoofing
- New Wave of SVG-Attachment Phishing — application/ecmascript MIME Evasion + XOR-Decoded Browser Redirect (chinougoo.cfd)
- Kali365 (K365) PhaaS Expansion — OAuth Device-Code Token Theft Beyond M365 to Okta SSO, AWS, Xerox DocuShare & MAX Messenger (126-Host Cluster, Live C2 Panel)
Detection coverage for TL-2026-0959
As of 2026-06-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0959 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.