Mirage2FA phishing campaign hits 4,500 companies, bypasses Microsoft 365 2FA

AI digestMimile.ai EditorialAugust 25, 2026 at 04:56 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

Mirage2FA phishing campaign hits 4,500 companies, bypasses Microsoft 365 2FA

The Mirage2FA phishing-as-a-service campaign has targeted 4,532 organization email domains across the US and EU from 2024 to 2026. ANY.RUN research found 48% of targeted email addresses were potentially compromised, with 63.7% of victims in the United States. The campaign abuses legitimate Microsoft 365 login flows to bypass two-factor authentication and steal session cookies.

Key Facts

The Mirage2FA campaign targeted 4,532 unique organization email domains from 2024 to 2026.
ANY.RUN research found 48% of targeted email addresses were potentially compromised.
The United States accounted for 63.7% of total victims, with activity also observed in India, Singapore, the UK, Canada, Saudi Arabia, and South Africa.
ANY.RUN uncovered more than 9,000 potential compromise events involving cookie and password theft, SSO logins, and 2FA bypass.
Technology, manufacturing, and education were among the most targeted industries.

Campaign Scope

The Mirage2FA campaign has affected thousands of companies from 2024 to 2026, with activity potentially linked to 4,532 unique organization email domains. The United States accounted for 63.7% of total victims, while activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other countries. Technology, manufacturing, and education were among the most targeted industries. ANY.RUN research found 48% of targeted email addresses were potentially compromised.

Attack Method

Mirage2FA is a commercial phishing-as-a-service toolkit that targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. By stealing passwords and session cookies, attackers gain access to authenticated Microsoft 365 sessions and SSO-connected services. ANY.RUN's research uncovered more than 9,000 potential compromise events involving cookie and password theft, SSO logins, and 2FA bypass. Once an authenticated Microsoft 365 session is hijacked, a path for impersonation, fraud, and further compromise is created.

Risk Reduction

Organizations can reduce exposure by strengthening authentication, detecting campaign behavior, and treating session theft as an identity incident. ANY.RUN's Interactive Sandbox exposes redirects, scripts, WebSocket activity, and fake Microsoft 365 login pages to help SOC teams identify phishing behavior before account compromise. Moving beyond traditional MFA to phishing-resistant authentication and stronger session controls is recommended.

1 source

Mirage2FA phishing campaign hits 4,500 companies, bypasses Microsoft 365 2FA

thehackernews.com

The Hacker News

Technology

Check Point uncovers OAuth phishing campaign exploiting genuine Microsoft logins, targeting 120+ orgs

Check Point's email research team disclosed a phishing campaign that ran from late June into July 2026, abusing real Microsoft login pages to compromise accounts across over 120 organizations worldwide. The attackers sent fake Microsoft Teams notifications directing victims to a legitimate OAuth authorization URL, then tricked them into approving permissions for a malicious application, granting access to email, files, and messaging platforms without stealing passwords or defeating multi-factor authentication. The tactic eliminates the need for look-alike domains or credential harvesting, underscoring a shift in attacker methods.

Technology

Hudson Rock: TheHatman selling Azure data from McDonald's, TCS, Vodafone

A threat actor using the alias TheHatman is selling data allegedly stolen from the Azure/Entra tenants of McDonald's, Tata Consultancy Services, Vodafone, and other Fortune 500 firms, Hudson Rock reports. The advertised datasets include employee directories with names, emails, phone numbers, job titles, service accounts, and global admin identities, exposing personnel to spear-phishing and business email compromise. While no Azure zero-day flaw has been confirmed, Hudson Rock links the access to credentials compromised in a targeted infostealer campaign.

Technology

NovaCookies Phishing Kit Uses Genuine Docusign Notices to Steal Microsoft 365 Sessions

Cybersecurity researchers disclosed a new adversary-in-the-middle phishing toolkit called NovaCookies that redirects Microsoft 365 sign-ins and captures authenticated sessions. The $320-per-month subscription service has targeted hundreds of organizations across the U.S., U.K., Canada, Germany, Israel, and the U.A.E. Campaigns used genuine Docusign envelopes to carry counterfeit document-share lures, with some clicks routed through legitimate Microsoft or Google sign-in endpoints before reaching the kit.

Technology

CameraSwarm campaign compromises 14,530 Dahua devices in Ukraine, Russia

Hackers compromised more than 14,500 Dahua IP cameras in Ukraine and Russia between June 17 and July 22, 2026, Hunt.io researchers said. The 35-day operation used credential attacks, two authentication-bypass vulnerabilities, and a P2P relay to install persistent backdoor accounts on some devices. Both vulnerabilities remained in CISA's Known Exploited Vulnerabilities catalog as of August 19, 2026.

Mirage2FA phishing campaign hits 4,500 companies, bypasses Microsoft 365 2FA

Key Facts

Campaign Scope

Attack Method

Risk Reduction

Read more

Read more