Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU Organizations, Abusing Microsoft 365 Login Flows

Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU (TL-2026-2140), also tracked as Mirage2FA, is a high-severity phishing campaign, first published 2026-08-25. It is attributed to LinX Coders with medium confidence, affects Microsoft Microsoft 365 (Entra ID sign-in, Exchange Online, maps to 14 MITRE ATT&CK techniques (T1027, T1027.006, T1071.001), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-2140

Threat ID
TL-2026-2140
Also known as
Mirage2FA
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-08-25
Last reviewed
2026-08-25
Attribution
LinX Coders
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, manufacturing, education, consulting, telecoms
Target regions
North America, Europe, Asia, Middle East, Africa
Detection rules
9
Indicators of compromise
21

Malware and tooling in Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU

Malware and tooling: Mirage2FA, linxlogsss...bot

The commercial Mirage2FA phishing-as-a-service (PhaaS) kit, run by an operator identified as LinX Coders (LinXcoded), uses an adversary-in-the-middle reverse-proxy against real Microsoft 365 login flows to relay credentials and one-time passcodes to Microsoft in real time and steal the resulting authenticated session cookie. ANY.RUN sandbox telemetry links the kit to 3,518 targeted organization email domains, 9,426 targeted accounts, and 4,532 accounts (~48%) showing indicators of compromise across 9,000+ compromise events between September 2024 and July 2026, with the US accounting for 63.7% of victims and technology, manufacturing, and education the top-targeted sectors.

How Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU works

Mirage2FA is a subscription phishing-as-a-service platform, developed and operated by a group tracked as LinX Coders (Telegram/brand handle "LinXcoded"), purpose-built to compromise corporate Microsoft 365 accounts and hijack their authenticated sessions rather than crack or brute-force MFA. Victims receive email lures — commonly HR/benefits/401(k), invoice, secure-document, or payment-request themed — carrying browser-executable .htm, .xhtml, or .svg attachments, or a QR code ("quishing") pointing to a phishing URL. These stagers are heavily obfuscated (Base64 encoding, single-byte XOR with key 0xAD/173, TextDecoder/eval reconstruction, obfuscator.io-style `_0x` wrappers, and dynamic iframe injection) specifically to defeat static email-gateway and antivirus scanning; no compiled malware binary is ever involved, and the entire chain runs inside the victim's browser.

Once triggered, the stager pulls a second-stage loader script from attacker infrastructure via a path pattern of the form `/<3-letter-code>/xls/<token>.js` (e.g. the canonical `/api/xls/a1p2i.js`), with the victim's email address Base64-encoded into the request/DNS label as a per-recipient tracking token (config placeholders such as `LINXCODERSEMAIL` / `LINXB64EMAIL` were recovered in samples). The loader renders a pixel-accurate fake Microsoft 365 login page and, as the victim submits username, password, and one-time 2FA/authenticator code, relays that data over a persistent WebSocket channel to the real Microsoft 365 authentication endpoint in real time — an adversary-in-the-middle (AiTM) reverse-proxy technique that lets the legitimate login actually succeed while the kit captures the resulting valid session cookie. Some samples also embed fake CAPTCHA screens, spoofed authenticator/number-matching prompts, and (per code review, unconfirmed live) SMS-verification handling to keep victims inside the flow and suppress suspicion. The stolen, Base64-encoded session cookies are logged as text dumps in the operator's back-end panel and pushed to Telegram bots (`linxlogsss...bot`, `linxxlogss...bot`) for the purchasing affiliate to retrieve.

Operators reuse the harvested cookies to access the victim's mailbox, SharePoint, OneDrive, and any SSO-connected application without re-entering a password or MFA — enabling business email compromise, internal phishing pivots, fraud, and further account takeover. About one third of successful session captures originated from mobile-browser logins. Telemetry additionally shows attackers leveraging already-compromised, authenticated Microsoft 365 tenants to send further Mirage2FA lures, letting the campaign ride trusted-sender reputation and bypass conventional email filtering, and distributing lures at scale partly via Amazon SES. Infrastructure is concentrated on a small set of loader/AiTM domains (`cheacker.store` and subdomains, `volatilesour.store`, `bandhiem.com`, `pynutech.store`) and IPs in the 185.174.100.0/24 block (hosted on AS-Colocrossing), alongside 75+ short-lived phishing/typosquat domains impersonating payroll, benefits, and tax-service brands.

MITRE ATT&CK techniques used in TL-2026-2140

Defense Evasion

T1027 Obfuscated Files or Information; T1027.006 HTML Smuggling

Command and Control

T1071.001 Web Protocols

Persistence

T1078.004 Cloud Accounts

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle

Collection

T1114 Email Collection

Execution

T1204.002 Malicious File

Lateral Movement

T1550.004 Web Session Cookie

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1586.002 Email Accounts

Affected products and versions in Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU

  • Microsoft — Microsoft 365 (Entra ID sign-in, Exchange Online, SharePoint, OneDrive, SSO-federated applications)
    Vulnerable versions: Cloud service - not version-specific; abuses legitimate login flow rather than a software flaw
    Fixed in: N/A - social-engineering/session-theft technique, not a patchable vulnerability

Remediation for Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU

Immediate actions

  • Revoke all active sessions and refresh tokens for any Microsoft 365 account with suspected exposure, then force a password + MFA re-registration
  • Block/sinkhole known Mirage2FA infrastructure at the email gateway and web proxy: IP 185.174.100.224 and the 185.174.100.0/24 block, and domains cheacker.store, user.cheacker.store, volatilesour.store, hvr.volatilesour.store, bandhiem.com, ver.bandhiem.com, pynutech.store
  • Hunt mail logs for inbound .htm/.xhtml/.svg attachments and QR-code lures themed as HR, 401(k)/benefits, invoices, or secure-document requests
  • Audit OAuth application grants and inbox/mailbox-forwarding rules on any tenant with a suspected compromised session; inspect for outbound Mirage2FA lures sent from already-compromised mailboxes

Workarounds

  • Enable Microsoft Defender for Office 365 Safe Links/Safe Attachments scanning for .htm/.xhtml/.svg MIME types, which are commonly allow-listed by default filters
  • Train users to treat unexpected QR codes and HTML-file email attachments (particularly HR/benefits/invoice themed) as high-risk phishing lures

Longer-term hardening

  • Migrate high-value and admin accounts to FIDO2/WebAuthn hardware security keys or platform passkeys that cryptographically bind authentication to the legitimate origin, defeating AiTM proxies
  • Enforce Entra ID Continuous Access Evaluation (CAE) and shorter session/refresh-token lifetimes so a stolen cookie has a narrow usable window
  • Deploy Conditional Access policies requiring compliant/managed devices and token-binding for sign-in to sensitive applications
  • Move away from SMS/OTP-based MFA toward phishing-resistant methods across the tenant

Weaknesses (CWE) in Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU

CWE-294

Timeline of Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU

  • Earliest Mirage2FA test activity observed in ANY.RUN interactive sandbox telemetry
  • Mirage2FA phishing-as-a-service campaign begins ramping against Microsoft 365 tenants, per ANY.RUN/Fortra telemetry covering late 2024 onward
  • Cross-bot operator testing of the AiTM panel observed from IPs 185.174.100.76 (US) and 139.28.36.38 (Ukraine)
  • Continued operator/bot testing traffic recorded from IP 185.174.100.20, part of the shared 185.174.100.0/24 infrastructure block
  • Loader/harvesting domain cheacker[.]store registered, later used to serve WebSocket-based AiTM sessions
  • Fortra publishes technical analysis of the obfuscated HTML loader (Base64 + XOR 0xAD + eval) delivering the Mirage2FA Microsoft 365 MFA phishing kit
  • Latest confirmed Mirage2FA sandbox activity recorded in ANY.RUN telemetry, with 445 sandbox sessions logged in July alone marking a campaign escalation
  • Brinztech publishes a breach alert on LinXcoded's large-scale adversary-in-the-middle attacks against Microsoft 365 users
  • The Hacker News reports ANY.RUN's findings publicly, disclosing the full campaign scale: 4,532 potentially compromised organizations across 94 countries

Sources cited for Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU

Threats related to Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU

Detection coverage for TL-2026-2140

As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2140 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats