# Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU Organizations, Abusing Microsoft 365 Login Flows

> The commercial Mirage2FA phishing-as-a-service (PhaaS) kit, run by an operator identified as LinX Coders (LinXcoded), uses an adversary-in-the-middle reverse-proxy against real Microsoft 365 login flows to relay credentials and one-time passcodes to Microsoft in real time and steal the resulting authenticated session cookie. ANY.RUN sandbox telemetry links the kit to 3,518 targeted organization email domains, 9,426 targeted accounts, and 4,532 accounts (~48%) showing indicators of compromise across 9,000+ compromise events between September 2024 and July 2026, with the US accounting for 63.7% of victims and technology, manufacturing, and education the top-targeted sectors.

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2140
- **ID:** TL-2026-2140
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** LinX Coders
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Mirage2FA is a subscription phishing-as-a-service platform, developed and operated by a group tracked as LinX Coders (Telegram/brand handle "LinXcoded"), purpose-built to compromise corporate Microsoft 365 accounts and hijack their authenticated sessions rather than crack or brute-force MFA. Victims receive email lures — commonly HR/benefits/401(k), invoice, secure-document, or payment-request themed — carrying browser-executable .htm, .xhtml, or .svg attachments, or a QR code ("quishing") pointing to a phishing URL. These stagers are heavily obfuscated (Base64 encoding, single-byte XOR with key 0xAD/173, TextDecoder/eval reconstruction, obfuscator.io-style `_0x` wrappers, and dynamic iframe injection) specifically to defeat static email-gateway and antivirus scanning; no compiled malware binary is ever involved, and the entire chain runs inside the victim's browser.

Once triggered, the stager pulls a second-stage loader script from attacker infrastructure via a path pattern of the form `/<3-letter-code>/xls/<token>.js` (e.g. the canonical `/api/xls/a1p2i.js`), with the victim's email address Base64-encoded into the request/DNS label as a per-recipient tracking token (config placeholders such as `LINXCODERSEMAIL` / `LINXB64EMAIL` were recovered in samples). The loader renders a pixel-accurate fake Microsoft 365 login page and, as the victim submits username, password, and one-time 2FA/authenticator code, relays that data over a persistent WebSocket channel to the real Microsoft 365 authentication endpoint in real time — an adversary-in-the-middle (AiTM) reverse-proxy technique that lets the legitimate login actually succeed while the kit captures the resulting valid session cookie. Some samples also embed fake CAPTCHA screens, spoofed authenticator/number-matching prompts, and (per code review, unconfirmed live) SMS-verification handling to keep victims inside the flow and suppress suspicion. The stolen, Base64-encoded session cookies are logged as text dumps in the operator's back-end panel and pushed to Telegram bots (`linxlogsss...bot`, `linxxlogss...bot`) for the purchasing affiliate to retrieve.

Operators reuse the harvested cookies to access the victim's mailbox, SharePoint, OneDrive, and any SSO-connected application without re-entering a password or MFA — enabling business email compromise, internal phishing pivots, fraud, and further account takeover. About one third of successful session captures originated from mobile-browser logins. Telemetry additionally shows attackers leveraging already-compromised, authenticated Microsoft 365 tenants to send further Mirage2FA lures, letting the campaign ride trusted-sender reputation and bypass conventional email filtering, and distributing lures at scale partly via Amazon SES. Infrastructure is concentrated on a small set of loader/AiTM domains (`cheacker.store` and subdomains, `volatilesour.store`, `bandhiem.com`, `pynutech.store`) and IPs in the 185.174.100.0/24 block (hosted on AS-Colocrossing), alongside 75+ short-lived phishing/typosquat domains impersonating payroll, benefits, and tax-service brands.

## MITRE ATT&CK

- T1583.001 Domains
- T1586.002 Email Accounts
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1027 Obfuscated Files or Information
- T1027.006 HTML Smuggling
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1071.001 Web Protocols
- T1114 Email Collection
- T1078.004 Cloud Accounts

## Sources

- [Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows](https://thehackernews.com/2026/08/mirage2fa-surge-hits-4500-us-and-eu.html)
- [Mirage2FA: A Phishing Threat to US Companies with 4K Victims](https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/)
- [Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials](https://www.helpnetsecurity.com/2026/06/26/mirage2fa-phishing-kit-microsoft-365-html-smuggling/)
- [Hackers Let Microsoft 365 Users Complete MFA, Then Steal Logged-In Sessions](https://cybersecuritynews.com/microsoft-365-session-theft/)
- [Mirage2FA: Obfuscated HTML Loader Delivers Microsoft 365 MFA Phishing Kit](https://www.fortra.com/blog/mirage2fa-obfuscated-html-loader-delivers-microsoft-365-mfa-phishing-kit)
- ['Mirage2FA' (LinXcoded) Phishing-as-a-Service Platform Executes Large-Scale Adversary-in-the-Middle Attacks on Microsoft 365 Users](https://www.brinztech.com/breach-alerts/brinztech-alert-mirage2fa-linxcoded-phishing-as-a-service-platform-executes-large-scale-adversary-in-the-middle-attacks-on-microsoft-365-users)
- [Mirage2FA Hijacks Companies' Microsoft 365 Sessions, with Over 4K Victims in the US](https://hackernoon.com/mirage2fa-hijacks-companies-microsoft-365-sessions-with-over-4k-victims-in-the-us)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2140