Researchers tie the LinX Coders phishing-as-a-service toolkit to 9,332 compromise events across 94 countries, with 63.7% of victims in the United States and stolen session cookies accounting for more than half of all outcomes.

A phishing-as-a-service (PhaaS) toolkit tracked as Mirage2FA has been linked to the potential compromise of 4,532 Microsoft 365 accounts in a campaign that targeted 3,518 organizations, according to new research published by threat intelligence analysts ShiFu and raptur3 at ANY.RUN.

The kit does not drop malware. Instead, it uses browser-executed HTML, XHTML, and SVG attachments to funnel victims to a fake Microsoft login page backed by an adversary-in-the-middle (AiTM) reverse proxy.

The proxy relays the username, password, and one-time 2FA code to Microsoft in real time and captures the authenticated session cookie that comes back, letting the attacker enter the account without ever typing a password or completing MFA again.

*Mirage2FA phishing targets US companies in technology and manufacturing (Source: ANY.RUN)*

Nearly Half of Targeted Accounts Were Potentially Compromised

ANY.RUN’s telemetry shows the campaign reached 9,426 unique email addresses, and roughly 48% of them were potentially compromised.

Victim activity was logged in 94 countries, but the United States dominates with 2,885 victims, or 63.7% of the total, far ahead of India (5.1%), Singapore (4.1%), the United Kingdom (1.7%), and Canada (1.7%).

Technology companies were hit hardest at 19.2% of victims, followed by manufacturing (11.1%), education (9.9%), consulting (8.3%), telecommunications (6.6%), healthcare (5.4%), and finance (3.1%).

MSSPs also feature among the most affected sectors, a detail that matters because a single compromised provider account can expose the customers it manages.

The operator has been active since at least September 2024, but the tempo changed in 2026.

Sandbox detections began a steady climb in March, and July alone produced 445 Mirage2FA sessions in ANY.RUN’s Interactive Sandbox with the month only partially recorded, out of 1,249 sessions analyzed in total.

*ANY.RUN’s threat intelligence shows a steady rise in Mirage2FA attacks through 2026 (Source: ANY.RUN)*

*Technology and manufacturing are the main industries targeted by Mirage2FA (Source: ANY.RUN)*

*US companies are the core target of Mirage2FA attacks (Source: ANY.RUN)*

Get a full version of the Mirage2FA report for SOC and MSSP teams. A complete list of IOCs for your SIEM/EDR.

Session Cookies Make Up More Than Half of All Thefts

Of the 9,332 compromise events recorded, 4,561 (51%) involved the theft of an authenticated session cookie, affecting 2,541 unique victims.

Another 3,044 events (34%) captured a password together with a 2FA code, 1,339 (15%) were single sign-on logins, and 388 fell into other categories.

*Mirage2FA steals login information from affected companies, with cookie theft the most common outcome (Source: ANY.RUN)*

The dominance of cookie theft changes the incident response math. Because the attacker holds a valid session rather than just a password, a password reset does not evict them.

Mirage2FA stores the stolen cookies as Base64-encoded .txt dumps on its operator panel, ready to be replayed against Microsoft 365, SSO-connected applications, and internal workflows.

One in three successful login events (33.3%) came from mobile devices, where users have fewer visual cues to spot a phishing page.

The business impact reaches well beyond the mailbox. A hijacked identity gives the attacker trusted access to connected cloud services, enables fraud against employees, customers, and suppliers, and widens the blast radius to every SSO-connected application, while containment costs rise because a credential reset alone no longer closes the door.

Lower the cost of account compromise with early detection. Prevent a business incident with proactive defense.

The Full Attack Chain: From Attachment to Account Takeover

The attack begins with a phishing email, frequently themed around HR notices or 401(k) benefit updates and sent in volume through Amazon SES (MITRE ATT&CK T1566.001/.002).

The message carries a .htm, .xhtml, or .svg attachment, or a QR code that pushes the victim to open the phishing link on a phone.

*The entire attack flow of Mirage2FA, from phishing email to Microsoft 365 takeover (Source: ANY.RUN)*

When the victim opens the file, the browser runs an embedded stager (T1204.002). The stager carries a per-recipient token, the victim’s email address Base64-encoded into a placeholder named LINXB64EMAIL, and fetches the harvesting logic from a remote loader using a URL of the form /xls/

In ANY.RUN’s sandbox, the attachment first shows a “Verify you’re human” slider before loading a Microsoft-branded password prompt with the victim’s email already filled in.

Behind the page, the browser pulls the loader from user.cheacker[.]store, opens a WebSocket to the command-and-control server, posts to an xwps.php handler on a second domain, and queries api.ipify.org to fingerprint the victim’s IP address.

*Full attack chain analyzed inside ANY.RUN’s Interactive Sandbox: the quarantined email carries an .html attachment that launches the phishing flow (Source: ANY.RUN)*

*The fake verification step carried out inside ANY.RUN’s sandbox (Source: ANY.RUN)*

*Victims enter their credentials on a fake Microsoft login page while the loader, WebSocket, and IP-check traffic appear in the sandbox network log (Source: ANY.RUN)*

The credentials and 2FA code are relayed to the legitimate Microsoft service over that WebSocket channel (T1557, T1111).

Once Microsoft accepts them, the proxy receives a valid authenticated session, which is exfiltrated along with the credentials (T1539) and reused to read mail and impersonate the user (T1071.001).

Across the 1,249 sandbox sessions, the dominant behaviors were phishing, obfuscated JavaScript execution, WebSocket activity tied to the AiTM channel, IP and browser fingerprinting, QR-code delivery, and Amazon SES activity.

See the full attack chain in <60 sec. Reduce investigation time before account compromise turns into a larger incident.

Six Stager Variants, Zero Binary Malware

ANY.RUN catalogued 629 .htm samples (453 of them obfuscated), 198 XHTML samples (31 obfuscated), and 187 SVG samples (12 obfuscated).

The plain .htm variant is a two-line stub that sets a uid token and pulls /api/xls/a1p2i.js from the kit’s domain.

*Non-obfuscated .htm loader stub pulling a1p2i.js from pectech[.]store (Source: ANY.RUN)*

The non-obfuscated XHTML version builds a full-screen iframe, writes a document into it, and injects the same a1p2i.js loader, reading the token from a ?ref= parameter.

*Dynamic iframe plus remote loader in the plain XHTML variant (Source: ANY.RUN)*

Its obfuscated counterpart hides the logic behind a hex-to-string decoder, rsy(), and reads the token from ?sdv= or the URL fragment.

*Hex-string decoder used by the obfuscated XHTML stager (Source: ANY.RUN)*

The obfuscated .htm variant is self-contained: it Base64-decodes a blob, XORs every byte with 0xAD (173), and passes the result to eval().

*XOR + Base64 + eval loader with the 0xAD key in the obfuscated .htm variant (Source: ANY.RUN)*

SVG files abuse the