Hackers Let Microsoft 365 Users Complete MFA, Then Steal Logged-In Sessions
Brief
A sophisticated Phishing-as-a-Service (PhaaS) platform marketed as Mirage2FA is enabling threat actors to bypass multi-factor authentication (MFA) by allowing Microsoft 365 users to complete their regular login process before covertly stealing the authenticated session.
Threat researchers at ANY.RUN discovered that the Adversary-in-the-Middle (AiTM) framework generated thousands of potential compromise events from late 2024 through 2026, with the overwhelming majority resulting in hijacked session cookies rather than isolated password theft.
Hackers Steal Microsoft 365 Sessions After MFA
Instead of attempting to break MFA algorithms directly, Mirage2FA positions itself directly between the user and legitimate authentication endpoints.