# Mirage2FA Phishing Kit Targets Microsoft 365 via HTML Smuggling and MFA-Bypass Simulation

> Fortra identified Mirage2FA, an active phishing kit that delivers fake Microsoft 365 sign-in pages through short-lived HTML smuggling and heavily obfuscated JavaScript loaders. It gates victims behind a fake CAPTCHA and simulates authenticator-app, number-matching, and SMS MFA challenges to harvest credentials and second factors for Microsoft 365 account takeover.

- **Published:** 2026-06-27T00:00:00Z
- **Last reviewed:** 2026-06-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0959
- **ID:** TL-2026-0959
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Mirage2FA is a credential-phishing kit reported by Fortra in June 2026 that targets Microsoft 365 accounts. The campaign is delivered through business-themed email lures (secure documents, remittance services, automated billing, and payment requests) carrying an HTML/JavaScript attachment. When opened, the attachment performs HTML smuggling: the malicious payload is assembled and executed entirely in the victim's browser, avoiding a network fetch of the obvious malicious content at delivery time and evading static email/attachment inspection.

The initial HTML payload embeds obfuscated JavaScript to hide its behavior from static analysis. The deobfuscation chain combines Base64 decoding (atob()), a byte-wise XOR using the single-byte key 0xAD, TextDecoder to reconstruct the decoded byte stream into text, and eval() to execute the recovered code. This layered atob() + XOR(0xAD) + TextDecoder + eval() pattern is the kit's most distinctive host/static-analysis fingerprint and is the recommended high-fidelity detection anchor.

After the loader executes, the victim is presented with a Microsoft-branded page styled as a protected/loading business document. A fake CAPTCHA verification screen gates progression and lends legitimacy while filtering automated analysis. The victim is then walked through a counterfeit Microsoft 365 authentication flow that collects email and password, followed by MFA-simulation screens for authenticator-app codes, number-matching approvals, and SMS verification codes (SMS handling was present in the code but not confirmed fully operational). Harvested credentials and second factors enable Microsoft 365 account takeover, granting access to email, files, Teams messages, SharePoint content, and other connected SaaS resources.

Fortra's infrastructure analysis tied the campaign to the domain cheacker[.]store and the second-stage loader subdomain user[.]cheacker[.]store, additional infrastructure at miniapp[.]bereetro[.]it[.]com, the IP address 185.174.100.224, and JavaScript loader resources served from /eor/xls/e1o2r.js and /ulr/xls/u1l2r.js. The cheacker[.]store domain was registered on 2026-03-16, consistent with short-lived, disposable phishing infrastructure rather than a legitimate long-standing service. No CVE is involved; the threat is a social-engineering / AiTM-style credential-harvesting operation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.004 Server
- T1608.001 Upload Malware
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1027.006 HTML Smuggling
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1056.003 Web Portal Capture
- T1111 Multi-Factor Authentication Interception
- T1621 Multi-Factor Authentication Request Generation
- T1078.004 Cloud Accounts
- T1114.002 Remote Email Collection
- T1530 Data from Cloud Storage
- T1071.001 Web Protocols

## Sources

- [Mirage2FA: Obfuscated HTML Loader Delivers Microsoft 365 MFA Phishing Kit](https://www.fortra.com/blog/mirage2fa-obfuscated-html-loader-delivers-microsoft-365-mfa-phishing-kit)
- [Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials](https://www.helpnetsecurity.com/2026/06/26/mirage2fa-phishing-kit-microsoft-365-html-smuggling/)
- [MITRE ATT&CK: HTML Smuggling (T1027.006)](https://attack.mitre.org/techniques/T1027/006/)
- [MITRE ATT&CK: Multi-Factor Authentication Request Generation (T1621)](https://attack.mitre.org/techniques/T1621/)
- [MITRE ATT&CK: Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)
- [Microsoft: Defend against phishing with phishing-resistant MFA](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths)
- [MITRE ATT&CK: Web Portal Capture (T1056.003)](https://attack.mitre.org/techniques/T1056/003/)
- [Microsoft: Revoke user access and sign-in sessions in Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0959