# Your MFA Didn't Fail. The Session Did. Mirage2FA and the New Arithmetic of Account Takeover.
Two years. Four thousand five hundred companies. Forty-eight percent of targeted accounts potentially compromised.
Those numbers from ANY.RUN's research on Mirage2FA should land harder than they will. They won't, because "phishing campaign bypasses MFA" has become background noise — a genre of security news that produces a flash of concern and then disappears into the inbox alongside the thing it's describing. That's the problem. Mirage2FA isn't novel. It's a signal that adversarial-in-the-middle attacks have crossed from sophisticated threat-actor territory into full commodity infrastructure, and that the industry's default response — "enable MFA" — is now dangerously incomplete advice.
## How the Machine Works
Mirage2FA is a phishing-as-a-service toolkit, which means someone built it, packaged it, and sells or rents it to other criminals who lack the skill to build it themselves. This is the industrialization of attack surface. The kit targets Microsoft 365 by proxying the actual Microsoft login flow — when a victim enters their credentials on a fake page, the kit relays them to the real Microsoft server in real time, collects the valid session cookie from Microsoft's response, and hands the attacker an authenticated session. The victim's MFA code gets intercepted and forwarded the same way.
This is the adversary-in-the-middle (AiTM) technique. The 2FA prompt fires. The user completes it. The attacker gets the cookie. MFA never had a chance because the attack didn't try to guess it — it just borrowed the session that MFA granted.
What the attacker now holds isn't a password. It's an authenticated identity. The distinction matters enormously for how defenders need to respond, and it's where most incident response playbooks still fall short.
## The Numbers That Should Alarm You
ANY.RUN tracked Mirage2FA activity from 2024 through mid-2026 and identified 4,532 unique organization email domains tied to the campaign — not individual accounts, organizations. The firm logged more than 9,000 potential compromise events spanning cookie theft, password capture, SSO pivots, and 2FA bypasses.
Sixty-three percent of victims were US-based, but the campaign hit widely: India, Singapore, the UK, Canada, Saudi Arabia, South Africa. The targeted industries skew toward technology, manufacturing, and education — which makes sense. Tech companies tend to have high-value cloud access and sensitive IP. Manufacturers often have supplier-chain access and operational data that commands ransomware premiums. Education institutions have weak security postures and large footprints of student and faculty credentials.
The 48% potential compromise rate deserves a second read. This isn't the percentage of emails that got opened, or links that got clicked. Nearly half of the email addresses specifically targeted by Mirage2FA may have been successfully compromised. That's not a phishing campaign with a long tail of failures. That's a precision operation.
## Beyond the Inbox: Why SSO Changes Everything
The reason Mirage2FA is more damaging than a classic credential-phishing attack comes down to session scope. Microsoft 365 is rarely a standalone system. For most organizations, it's the identity spine. M365 accounts authenticate users into SharePoint, Teams, Azure services, third-party SaaS tools, and any application that trusts Entra ID. A hijacked M365 session is often a hijacked enterprise identity.
That attack radius — what the research calls follow-on access through SSO-connected apps — means containment can't stop at a password reset. If an attacker spent four hours in a compromised session before detection, they may have authenticated into Salesforce, accessed a file share, exfiltrated Teams messages, or registered a new OAuth application for persistent access. Password reset revokes the credential. It doesn't revoke what the attacker already obtained.
## What Defenders Are Getting Wrong
The industry advice has consistently emphasized MFA adoption. But MFA-as-deployed — TOTP codes, SMS, push notifications — is precisely what Mirage2FA is built to defeat. These authentication factors were designed to protect the login event, not the authenticated session.
Phishing-resistant MFA — FIDO2 hardware keys, passkeys, device-bound credentials — operates differently. These schemes cryptographically bind the authentication to the legitimate origin, so an AiTM proxy can't intercept and replay a valid credential. The attacker can forward a phishing URL all they want; the passkey will refuse to authenticate to a domain that isn't Microsoft's.
Adoption of phishing-resistant MFA remains frustratingly low, especially outside regulated industries. Cost, user friction, and deployment complexity are the usual reasons given. Four thousand five hundred companies and 9,000 compromise events in two years is the argument for reconsidering that calculus.
Session management is the second gap. Organizations need to treat hijacked sessions as identity incidents, not login events. That means monitoring session anomalies (new IP geolocation, device fingerprint shifts, unusual access times), implementing Conditional Access policies that continuously re-evaluate trust rather than trusting the initial login, and having runbooks that treat session revocation — across all tokens, all apps — as the first response action, not a password reset.
## HackWire Analysis
Mirage2FA didn't invent anything. EvilProxy, Evilginx, Modlishka, LabHost, Caffeine — AiTM toolkits have existed for years, and the technique of proxying legitimate authentication flows to steal session cookies has been documented since at least 2017. What Mirage2FA represents is a maturation of the commercial PhaaS market to the point where this capability is accessible to less sophisticated actors at scale.
That commoditization curve should be alarming to anyone who benchmarks their security program against "known advanced threats." Mirage2FA isn't APT infrastructure. It's off-the-shelf. The attackers using it don't need to understand AiTM at a technical level — they just need to rent the kit and run a phishing campaign. That means the threat population just grew substantially.
The geographic data also tells a story: 63% US victims, but meaningful hits in India, Singapore, Saudi Arabia, and South Africa. These aren't targets of opportunity — they're where significant enterprise Microsoft 365 deployments exist. Attackers are mapping the product's user base and following it globally, which makes this a pressure test for every large M365 tenant, not just Western enterprises.
The bigger pattern here is identity becoming the primary attack surface. We've spent decades hardening network perimeters, endpoints, and applications. Identity — specifically the session token that proves you are who you are — has become the soft underbelly. Mirage2FA exploits the fact that most organizations still treat authentication as a moment rather than a continuous process.
The concrete near-term action for security teams: audit your Conditional Access policies for continuous evaluation settings, review which applications have OAuth access to your M365 tenant (especially any registered in the past 90 days), and run a tabletop on "what do we do when we confirm a session cookie was stolen" — not "when we confirm a password was stolen." Those are different incidents requiring different responses, and most IR playbooks haven't caught up.
— HackWire Editorial
---
## Related Coverage