Mirage2FA Phishing Campaign Targets Microsoft 365 Sessions

A new phishing operation is showing why MFA alone cannot stop every modern account takeover.

Security researchers have identified Mirage2FA, a Phishing-as-a-Service platform designed to steal authenticated Microsoft 365 sessions. Instead of trying to defeat MFA itself, the toolkit captures the user’s session after the legitimate authentication process has already been completed.

How the Attack Works

Mirage2FA uses an Adversary-in-the-Middle (AiTM) approach.

Victims are directed to a fake Microsoft 365 login page that looks legitimate. When they enter their username, password, and MFA code, the phishing infrastructure relays the information to Microsoft’s real authentication service.

The important difference is what happens next.

After Microsoft successfully authenticates the user, the attacker intercepts the resulting session cookie. This can allow the attacker to reuse the authenticated session without asking the victim to complete MFA again.

Stolen Sessions Can Provide Broad Access

A compromised Microsoft 365 session can potentially give attackers access to services available to the victim, including:

Email
OneDrive
SharePoint
Microsoft 365 applications
Enterprise SSO services

This makes session theft particularly dangerous because changing the victim’s password alone may not immediately remove an already active session.

Large-Scale Targeting

Research telemetry associated with Mirage2FA shows that the campaign has targeted thousands of accounts across organizations in multiple countries.

Organizations in the United States represented the largest portion of identified victims, with additional activity observed in countries including India, the United Kingdom, Canada, Singapore, Saudi Arabia, and South Africa.

The campaign has affected a range of industries, with technology, manufacturing, and education among the prominent targets.

Phishing Without Traditional Malware

Another concerning aspect of the campaign is that the attack can operate largely through the victim’s browser.

Attackers have used files such as HTML, XHTML, and SVG as phishing lures. These files can contain scripts that redirect victims to malicious infrastructure and initiate the credential and session-harvesting process.

Because the attack does not necessarily require a traditional malware installation, conventional endpoint defenses may not always detect the activity.

Why MFA Is Not Enough

MFA remains an important security control, but AiTM attacks demonstrate an important limitation.

The attacker does not necessarily need to break the MFA mechanism. Instead, they trick the victim into completing MFA on a fraudulent page and then steal the authenticated session created afterward.

This turns session protection into an equally important part of identity security.

What Security Teams Should Do

Organizations should take several steps to reduce the impact of session-hijacking attacks:

Enable phishing-resistant authentication such as FIDO2 security keys.
Use Microsoft Entra Continuous Access Evaluation (CAE) where appropriate.
Monitor unusual sign-in and session activity.
Review suspicious OAuth applications and permissions.
Investigate unexpected access to Microsoft 365 resources.
Immediately revoke active sessions when an account compromise is suspected.
Train employees to verify login URLs before entering credentials or MFA codes.

Password Resets May Not Be Enough

When a session cookie has already been stolen, simply changing the user’s password may not fully resolve the incident.

Security teams should revoke active sessions and refresh tokens, investigate the affected account, review authentication activity, and check for unauthorized changes or applications.

The Bigger Picture

Mirage2FA highlights how cybercriminals are moving beyond traditional credential theft.

The objective is no longer simply to obtain a username and password. Attackers increasingly want to capture an already authenticated session and use it to operate as the legitimate user.

For organizations using Microsoft 365 and cloud-based identity platforms, protecting the authentication process is only one part of the equation. Detecting and controlling suspicious sessions is becoming just as important.