Mirage2FA: AiTM Phishing Kit Hits 3,500 Organizations, Bypasses MFA on Microsoft 365

On August 18, 2026, ANY.RUN published an analysis tracking the activity of the Mirage2FA phishing-as-a-service kit, operated by the LinX Coders group. The report documents over 9,400 targeted email addresses and an estimated compromise rate near 48%, with a concentration of 63.7% of victims in the United States. The data clarifies a stubborn technical point for many security teams: multi-factor authentication, when isolated from other controls, does not stop an AiTM attack executed entirely in the browser.

How the Browser-Based Attack Chain Works

Mirage2FA launches from HTML, XHTML, or SVG stagers attached to emails or delivered via QR code. ANY.RUN isolated 629 .htm samples — 176 in cleartext and 453 obfuscated — plus 198 XHTML files and 187 SVGs. These stagers contain tokens in the LINXB64EMAIL pattern that identify the victim.

Once opened, the file fetches a remote loader from a structured path such as /xls/<token>.js. The code then presents a phishing page replicating the Microsoft 365 interface, but operating behind an AiTM proxy. The victim's credentials and entered 2FA code are relayed in real time via WebSocket to the legitimate service. Microsoft's server responds with an authenticated session, which the operators capture and re-inject. The result: full access without ever touching the endpoint with a malicious executable.

ANY.RUN mapped the chain to MITRE ATT&CK IDs T1557 (Adversary-in-the-Middle) and T1111 (Multi-Factor Authentication Interception). The choice of file-based, non-executable techniques explains why the dataset records no binary malware: the payload lives in the DOM and browser memory, not on the filesystem.

"All victim, compromise, and campaign-scale figures in this report are approximate estimates based on the available dataset and represent potential impact rather than independently confirmed compromises"

Geography and the Weight of Mobile in the Dataset

ANY.RUN's numbers show an asymmetric distribution: 2,885 victims, 63.7% of the total, are concentrated in the United States, with activity detected in 94 countries. The report adds a relevant methodological caveat: sandbox submissions reflect where ANY.RUN analysts encounter and investigate samples, not necessarily where attackers find real victims. This introduces a potential geographic bias, given the platform's customer base is concentrated in U.S. and EU markets.

A figure that warrants attention is the 33.3% of successful logins originating from mobile devices. This is not a residual share: one in three compromised sessions passes through smartphones and tablets, where the reduced interface and absence of visual security indicators amplify the proxy's effectiveness. .htm attachments and QR codes integrate naturally into mobile workflows, where opening external links is more frequent and less scrutinized.

LinX Coders' Commercial Structure

The kit's operators identify as "LinX Coders" and leave LINX* markers in tokens and command-and-control domains. The ANY.RUN report lists infrastructure hosted on *.cheacker.store and *.volatilesour.store domains, with references to a Telegram channel named LinXcoded. This profile combines advanced relay techniques with a low-cost distribution model: the PhaaS lowers the barrier to entry for attackers who lack proxy development or C2 infrastructure skills.

The observed time window spans September 2024 through July 2026. In July 2026 alone, the partial ANY.RUN dataset records 445 Mirage2FA sandbox sessions. Total successful compromise events in the open-source dataset rise to 9,332, with 3,044 passwords captured and 1,589 second-factor compromises. These numbers do not represent global industry statistics: they are limits of the proprietary dataset, explicitly qualified as approximate estimates.

Why This Matters

The dossier does not specify countermeasures released by Microsoft nor official vendor advisories. It is not documented whether the listed C2 domains have been taken down or if law enforcement operations have hit LinX Coders. The source provides no guidance on how target organizations should modify their security controls.

The report surfaces a technical reality that IT departments must internalize: when the attack lives entirely in the browser, the traditional perimeter shifts. Endpoint solutions that hunt for executable files, anomalous processes, or disk persistence do not intercept an AiTM proxy operating in the context of a legitimate browser process. The detection point moves from the machine to the session, from credentials to the authentication token.

The soundest reading the dossier permits is that Mirage2FA represents the commoditization of AiTM: known techniques — 2FA code relay via WebSocket is not new — packaged into a commercial service with Telegram channel support and ready-to-use infrastructure. This model expands the attacker pool from nation-states and advanced groups to less sophisticated operators with limited budgets.

The illusion of MFA as a sufficient control shatters on a numeric data point: 1,589 times the second factor was successfully captured and relayed in the ANY.RUN dataset. Not because MFA is broken, but because it was implemented without correlated session controls: which device requests it, from which geolocation, with which browser fingerprint. The Mirage2FA kit does not attack the factor; it attacks the context in which the factor is entered.

For security leaders, the message is not to abandon MFA, but to stop treating it as a terminal checkpoint. The report provides no roadmap, but its technical core indicates where to shift focus: from "the user entered a code and password" to "the generated session is being used in a manner consistent with the user's historical profile."

Information is based on the cited advisory and current as of publication.

Sources

• https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
• https://hackernoon.com/mirage2fa-hijacks-companies-microsoft-365-sessions-with-over-4k-victims-in-the-us
• https://any.run/?utm_source=anyrunblog&utm_medium=article&utm_campaign=mirage2fa-phishing-blog&utm_term=180826&utm_content=linktolanding
• https://any.run/by-industry/technology/?utm_source=anyrunblog&utm_medium=article&utm_campaign=mirage2fa-phishing-blog&utm_term=180826&utm_content=linktotechnology
• https://any.run/by-industry/manufacturing/?utm_source=anyrunblog&utm_medium=article&utm_campaign=mirage2fa-phishing-blog&utm_term=180826&utm_content=linktomanufacturing

Information is based on the cited source and current as of publication.

Sources