Mirage2FA AiTM PhaaS + T-Mobile Smishing Credential Campaigns: OTX Pulse Analysis — Session Hijack Detection Pack

---
title: Mirage2FA AiTM Phishing Infrastructure - Network Connection
id: 7c1a9e42-m2fa-2026-0001
status: experimental
description: Detects network connections to known Mirage2FA phishing-as-a-service landing domains and hostnames identified in OTX pulse analysis (Sep 2026). Targets AiTM M365 session-hijack infrastructure operated by LinX Coders.
author: Security Arsenal Threat Intelligence
references:
  - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
date: 2026/09/19
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'galatasaraydanhaberler.com'
      - 'sopbtech.store'
      - 'pcvgtech.store'
      - 'verpox.shop'
      - 'cementslabconstruction.com'
      - 'pslcertlive.site'
      - 'rsxbenefits.com'
      - 'vslbertlive.info'
  condition: selection_domain
falsepositives:
  - Threat intelligence researchers intentionally visiting infrastructure
level: high
tags:
  - attack.credential_access
  - attack.t1557
  - attack.t1566.002
---
title: WebSocket Connection From Browser Process To Suspicious TLD
id: 7c1a9e42-m2fa-2026-0002
status: experimental
description: Detects WebSocket upgrade requests initiated by browser processes to low-reputation TLDs associated with Mirage2FA session exfiltration. WebSocket-based C2 is a distinguishing artifact of this PhaaS toolkit.
author: Security Arsenal Threat Intelligence
references:
  - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
date: 2026/09/19
logsource:
  category: proxy
detection:
  selection_upgrade:
    cs-header|contains: 'Upgrade: websocket'
  selection_tld:
    c-uri|endswith:
      - '.store'
      - '.shop'
      - '.site'
      - '.info'
      - '.top'
  condition: selection_upgrade and selection_tld
falsepositives:
  - Legitimate SaaS applications on budget TLDs (rare in enterprise environments)
level: medium
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
---
title: T-Mobile Smishing Domain Pattern - DNS Query
id: 7c1a9e42-tmob-2026-0003
status: experimental
description: Detects DNS queries matching the templated T-Mobile rewards smishing hostname pattern (t-mobile.<random>.top) observed in the active smishing campaign since May 2026.
author: Security Arsenal Threat Intelligence
date: 2026/09/19
logsource:
  category: dns
detection:
  selection:
    query|re: 't-mobile\.[a-z0-9]{5,12}\.top$'
  condition: selection
falsepositives:
  - None expected; legitimate T-Mobile services do not operate on .top TLD
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1598.003

// Mirage2FA AiTM + Smishing infrastructure hunt - Microsoft Sentinel
// Hunts endpoint network events against OTX pulse IOCs and WebSocket exfil behavior
let AiTM_IOCs = dynamic([
  "galatasaraydanhaberler.com", "sopbtech.store", "office.pcvgtech.store",
  "ver.verpox.shop", "cementslabconstruction.com", "adp.pslcertlive.site",
  "ans.rsxbenefits.com", "ari.vslbertlive.info"
]);
let SmishingPattern = @"t-mobile\.[a-z0-9]{5,12}\.top";
union isfuzzy=true
  (DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemoteUrl has_any (AiTM_IOCs) or RemoteUrl matches regex SmishingPattern
  | extend Detection = iff(RemoteUrl matches regex SmishingPattern, "Smishing-Domain", "Mirage2FA-AiTM")
  | project TimeGenerated, Detection, DeviceName, InitiatingProcessAccountName,
            InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType),
  (DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  // HTML smuggling: browser spawning script interpreters or opening local HTML payloads
  | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe")
    and FileName in~ ("rundll32.exe","mshta.exe","powershell.exe","wscript.exe")
  | project TimeGenerated, Detection = "HTML-Smuggling-ChildProc", DeviceName,
            AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName)
| sort by TimeGenerated desc

# Mirage2FA / Smishing IOC Hunt Script - Security Arsenal
# Checks DNS cache, browser activity artifacts, and M365 inbox rule persistence
$ErrorActionPreference = 'SilentlyContinue'

$AiTMHosts = @(
  'galatasaraydanhaberler.com','sopbtech.store','pcvgtech.store','verpox.shop',
  'cementslabconstruction.com','pslcertlive.site','rsxbenefits.com','vslbertlive.info'
)
$SmishingRegex = 't-mobile\.[a-z0-9]{5,12}\.top'
$findings = @()

Write-Host "[*] Checking DNS client cache for AiTM/smishing infrastructure..." -ForegroundColor Cyan
Get-DnsClientCache | ForEach-Object {
  foreach ($ioc in $AiTMHosts) {
    if ($_.Entry -like "*$ioc*") { $findings += "[HIT] DNS cache: $($_.Entry) -> $($_.Data)" }
  }
  if ($_.Entry -match $SmishingRegex) { $findings += "[HIT] DNS cache (smishing pattern): $($_.Entry)" }
}

Write-Host "[*] Checking active/established connections to IOC-related IPs..." -ForegroundColor Cyan
$iocIPs = foreach ($ioc in $AiTMHosts) { (Resolve-DnsName $ioc -ErrorAction SilentlyContinue).IPAddress }
Get-NetTCPConnection -State Established | ForEach-Object {
  if ($iocIPs -contains $_.RemoteAddress) {
    $proc = (Get-Process -Id $_.OwningProcess).ProcessName
    $findings += "[HIT] Active connection: $($_.RemoteAddress):$($_.RemotePort) by $proc (PID $($_.OwningProcess))"
  }
}

Write-Host "[*] Checking browser history for phishing domain visits (Chrome/Edge)..." -ForegroundColor Cyan
$histPaths = @(
  "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
  "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($hp in $histPaths) {
  if (Test-Path $hp) {
    $tmp = "$env:TEMP\hist_$(Get-Random).db"
    Copy-Item $hp $tmp -Force
    # String scan fallback if sqlite tooling is absent
    $raw = [System.IO.File]::ReadAllBytes($tmp)
    $txt = [System.Text.Encoding]::ASCII.GetString($raw)
    foreach ($ioc in $AiTMHosts) { if ($txt -match [regex]::Escape($ioc)) { $findings += "[HIT] Browser history artifact contains: $ioc ($hp)" } }
    if ($txt -match $SmishingRegex) { $findings += "[HIT] Browser history matches smishing domain pattern ($hp)" }
    Remove-Item $tmp -Force
  }
}

Write-Host "[*] Checking for suspicious recently created HTML files (HTML smuggling payloads)..." -ForegroundColor Cyan
Get-ChildItem "$env:USERPROFILE\Downloads" -Filter *.html -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) } | ForEach-Object {
    $content = Get-Content $_.FullName -Raw
    if ($content -match 'atob\(|Blob\(|navigator\.msSaveBlob' -and $content.Length -gt 20000) {
      $findings += "[HIT] Suspected HTML smuggling file: $($_.FullName) (created $($_.CreationTime))"
    }
  }

Write-Host "`n========== HUNT RESULTS ==========" -ForegroundColor Yellow
if ($findings.Count -eq 0) { Write-Host "No indicators found on this host." -ForegroundColor Green }
else { $findings | ForEach-Object { Write-Host $_ -ForegroundColor Red } }
Write-Host "==================================`n"
Write-Host "REMINDER: If any HIT occurs, immediately revoke the user's Entra ID sessions and refresh tokens,"
Write-Host "audit inbox rules + registered MFA methods, and enforce re-registration of phishing-resistant MFA."