A widespread phishing campaign leveraging a commercial toolkit has compromised authentication systems across 4,500 organizations in the United States and Europe over the past two years. The Mirage2FA campaign exploits legitimate Microsoft 365 login flows to defeat two-factor authentication protections, according to research from ANY.RUN.
The toolkit operates as phishing-as-a-service, meaning threat actors rent access to pre-built infrastructure rather than building attacks from scratch. This model dramatically lowers the barrier to entry for cybercriminals. The campaign targets Microsoft 365 credentials specifically, focusing on the most widely deployed business email platform globally. Attackers bypass 2FA by positioning themselves in the authentication stream itself, intercepting credentials before secondary verification occurs.
Approximately 48 percent of targeted email addresses showed signs of potential compromise, according to ANY.RUN's analysis. The actual breach rate could be higher, as this figure reflects only detected cases. The majority of affected organizations operate in the United States, though European entities also face exposure. No specific industry sectors have been identified as disproportionately targeted, suggesting the campaign casts a wide net across commercial entities.
The mechanics of Mirage2FA differ from typical phishing attacks. Rather than mimicking Microsoft login pages, the toolkit abuses legitimate authentication flows. Attackers position themselves between users and Microsoft's servers, capturing credentials and session tokens as they pass through. This approach proves harder to detect than standard phishing pages because users interact with actual Microsoft infrastructure. The legitimate-looking authentication flow reduces user suspicion significantly.
Microsoft 365 access grants attackers entry to email, calendar, contacts, and cloud storage. They gain ability to read sensitive communications, access financial documents, and establish persistence through mailbox forwarding rules. Many organizations rely on Microsoft 365 as their primary communication and collaboration platform, making compromise particularly damaging. Email access alone enables lateral movement across networks and social engineering of other staff members.
The phishing-as-a-service model enables prolific campaigns at scale. Individual threat actors do not require technical expertise in building phishing infrastructure. They simply subscribe to toolkit access, customize templates, and launch campaigns. This commoditization of attack tools explains the high volume of targeted organizations. The campaign spanned 2024 through 2026, indicating sustained operational activity over multiple years.
Organizations relying solely on password-based authentication face heightened risk. Those with 2FA enabled but using vulnerable methods like SMS or email links remain susceptible to interception attacks. Hardware security keys and authenticator apps provide stronger resistance to this attack vector, as they verify the authenticity of the login endpoint itself rather than simply confirming the user's identity.
Detection of Mirage2FA compromise requires reviewing Microsoft 365 audit logs for suspicious activity. Organizations should examine login patterns, inbox rule creation, and unusual delegate access. Credential-stuffing attempts against other services may indicate compromised credentials sold on underground forums.
Remediation involves forcing password resets for affected accounts, enabling hardware-based MFA where feasible, and implementing conditional access policies. Organizations should restrict authentication to managed devices and geographic regions where employees actually operate. Review of mailbox forwarding rules and OAuth grants should identify attacker persistence mechanisms installed during the compromise window.