A phishing-as-a-service toolkit called Mirage2FA has been targeting organizations by abusing real Microsoft 365 login pages through a man-in-the-middle proxy. The attackers capture usernames, passwords, and live two-factor authentication codes, then take over the user’s session using stolen session cookies, meaning a password reset alone may not kick them out.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You click an email: “Action required: Microsoft 365 session expired, sign in to continue.” You log in, approve 2FA… and they still get in. This is Mirage2FA, an adversary-in-the-middle kit that abuses real Microsoft 365 login pages, grabs your username, password, and live 2FA code, then steals the session cookie. Here’s the twist: they don’t just have your password; they hijack your active Microsoft 365 session. So even if you change your password, their stolen session cookie can keep them inside. If an email link makes you sign in to Microsoft 365 and approve 2FA unexpectedly, stop using that tab and go to Microsoft 365 from your bookmark or our official portal instead.
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…
