Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
Summary: The Mirage2FA phishing-as-a-service toolkit targeted Microsoft 365 accounts from 2024 to 2026 by abusing legitimate login flows and bypassing two-factor authentication, with ANY.RUN research linking the activity to 4,532 unique organization email domains. ANY.RUN found 48% of targeted email addresses were potentially compromised and uncovered more than 9,000 potential compromise events involving cookie and password theft, SSO logins, and 2FA bypass, with 63.7% of victims in the United States.
What you should know: Attackers stole session cookies, not just passwords, so a hijacked Microsoft 365 session opens SSO-connected apps and internal workflows and widens the attack radius beyond the first account. With 4,532 domains touched and 48% of targeted addresses potentially compromised, a password reset alone does not close the incident.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026