Mirage2FA AitM Phishing-as-a-Service: Microsoft 365 Session Hijacking Campaign (LinX Coders) — OTX Detection Pack

---
title: HTML Smuggling Attachment Opened by Browser or Email Client
id: 7f2a1c4e-9b3d-4e2a-8c1f-mirage2fa001
status: production
description: Detects execution of HTML attachments from email clients consistent with Mirage2FA HTML smuggling delivery, where browser or msedge/chrome is spawned from Outlook/Teams with an .html/.htm attachment in a temp or downloads path.
references:
  - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
author: Security Arsenal Threat Intelligence
date: 2026/08/20
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1027.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_parent_mail:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\ms-teams.exe'
      - '\thunderbird.exe'
  selection_html_path:
    CommandLine|contains:
      - '\Temp\'
      - '\Downloads\'
      - '\INetCache\'
      - 'Content.Outlook'
  selection_ext:
    CommandLine|contains:
      - '.htm'
      - '.html'
  condition: selection_browser and selection_parent_mail and selection_html_path and selection_ext
falsepositives:
  - Legitimate HTML reports opened from email
level: high
---
title: Suspicious WebSocket Connection to Known Mirage2FA PhaaS Infrastructure
id: 8a3b2d5f-1c4e-5f3b-9d2a-mirage2fa002
status: production
description: Detects network connections from browser processes to Mirage2FA phishing infrastructure identified in OTX pulse, indicating a user may have entered Microsoft 365 credentials on an AitM proxy page.
references:
  - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
author: Security Arsenal Threat Intelligence
date: 2026/08/20
tags:
  - attack.collection
  - attack.t1557
  - attack.t1539
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:
      - '192.52.166.55'
      - '209.205.197.130'
      - '181.214.165.173'
      - '83.147.53.130'
  selection_domain:
    DestinationHostname|contains:
      - 'galatasaraydanhaberler.com'
      - 'sopbtech.store'
      - 'pcvgtech.store'
      - 'verpox.shop'
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: (selection_ip or selection_domain) and selection_browser
falsepositives:
  - None expected; these are dedicated phishing infrastructure indicators
level: critical
---
title: Microsoft 365 Session Token Replay — Impossible Travel After Phishing Infrastructure Contact
id: 9c4d3e6a-2f5b-6a4c-1e3b-mirage2fa003
status: production
description: Detects post-compromise session hijacking behavior following Mirage2FA AitM theft — Entra ID sign-in from anomalous ASN/geography using a previously issued session token (no new MFA prompt) within hours of user contact with phishing infrastructure.
references:
  - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
author: Security Arsenal Threat Intelligence
date: 2026/08/20
tags:
  - attack.initial_access
  - attack.t1550.004
  - attack.t1078
logsource:
  product: azure
  service: signinlogs
detection:
  selection_success:
    properties.status.errorCode: 0
  selection_token_reuse:
    properties.authenticationRequirement: 'singleFactorAuthentication'
  selection_risk:
    properties.riskLevelDuringSignIn:
      - 'medium'
      - 'high'
      - 'none'
  filter_microsoft_asns:
    properties.networkLocationDetails|contains: 'Microsoft'
  condition: selection_success and selection_token_reuse and not filter_microsoft_asns
falsepositives:
  - VPN egress changes
  - Mobile carrier NAT traversal
level: high

// Mirage2FA AitM PhaaS Hunt — Microsoft Sentinel / Defender XDR
// Hunts for endpoint contact with OTX phishing infrastructure, then pivots to identity compromise
let Mirage2FA_IPs = dynamic(["192.52.166.55", "209.205.197.130", "181.214.165.173", "83.147.53.130"]);
let Mirage2FA_Domains = dynamic(["galatasaraydanhaberler.com", "sopbtech.store", "pcvgtech.store", "verpox.shop"]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteIP in (Mirage2FA_IPs)
       or RemoteUrl has_any (Mirage2FA_Domains)
    | project NetworkTime=TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName,
              InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, ActionType;
NetworkHits
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(90d)
    | where ResultType == 0
    | where AuthenticationRequirement == "singleFactorAuthentication"  // session token replay — no fresh MFA
    | project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,
              UserAgent, LocationDetails, RiskLevelDuringSignIn
) on $left.InitiatingProcessAccountName == $right.UserPrincipalName
| where SigninTime between (NetworkTime .. NetworkTime + 48h)
| summarize FirstNetworkContact=min(NetworkTime), SuspiciousSignins=count(),
            SigninIPs=make_set(IPAddress), Apps=make_set(AppDisplayName),
            Locations=make_set(LocationDetails)
  by UserPrincipalName, DeviceName, RemoteUrl
| order by FirstNetworkContact asc

<#
.SYNOPSIS
    Mirage2FA AitM Compromise Hunt — Security Arsenal IR Script
.DESCRIPTION
    Checks a Windows endpoint for evidence of Mirage2FA phishing contact:
      1. DNS cache hits for known PhaaS domains
      2. Active/historical TCP connections to OTX-listed IPs
      3. Browser history artifacts (Edge/Chrome) for phishing URLs
      4. Recently opened HTML attachments in Outlook temp paths (HTML smuggling)
      5. Scheduled tasks / run keys created around contact window (post-BEC staging)
.NOTES
    Run elevated. Output written to $env:TEMP\Mirage2FA_Hunt_<timestamp>.txt
#>

$ReportFile = "$env:TEMP\Mirage2FA_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
$BadIPs     = @('192.52.166.55','209.205.197.130','181.214.165.173','83.147.53.130')
$BadDomains = @('galatasaraydanhaberler.com','sopbtech.store','pcvgtech.store','verpox.shop','ver.verpox.shop','office.pcvgtech.store')

"=== Mirage2FA Endpoint Hunt — $(Get-Date) ===" | Out-File $ReportFile

"`n[1] DNS Cache Check`n------------------" | Out-File $ReportFile -Append
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $d = $_.Entry; $BadDomains | Where-Object { $d -like "*$_*" }
}
if ($dns) { $dns | Format-Table Entry, Data, TimeToLive | Out-String | Out-File $ReportFile -Append
            "[!] ALERT: Phishing domain found in DNS cache — user likely visited AitM page" | Out-File $ReportFile -Append }
else { "[+] No malicious domains in DNS cache" | Out-File $ReportFile -Append }

"`n[2] Network Connection Check`n----------------------------" | Out-File $ReportFile -Append
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $BadIPs -contains $_.RemoteAddress }
if ($conns) { $conns | Format-Table LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess | Out-String | Out-File $ReportFile -Append
              "[!] ALERT: Active/historical connection to Mirage2FA infrastructure" | Out-File $ReportFile -Append }
else { "[+] No connections to known Mirage2FA IPs" | Out-File $ReportFile -Append }

"`n[3] HTML Smuggling Artifact Check (Outlook Secure Temp)`n--------------------------------------------------------" | Out-File $ReportFile -Append
$outlookTemp = Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Windows\INetCache\Content.Outlook" -Recurse -Include *.htm,*.html -ErrorAction SilentlyContinue |
               Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
if ($outlookTemp) { $outlookTemp | Format-Table FullName, LastWriteTime | Out-String | Out-File $ReportFile -Append
    foreach ($f in $outlookTemp) {
        $content = Get-Content $f.FullName -Raw -ErrorAction SilentlyContinue
        if ($content -match 'atob|Blob|createObjectURL|msSaveBlob|login.microsoftonline' -and $content -match $BadDomains -join '|') {
            "[!] ALERT: Suspicious HTML smuggling attachment: $($f.FullName)" | Out-File $ReportFile -Append
        }
    }
} else { "[+] No recent HTML attachments in Outlook cache" | Out-File $ReportFile -Append }

"`n[4] Browser History Check (Edge)`n----------------------------------" | Out-File $ReportFile -Append
$histPath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
if (Test-Path $histPath) {
    $tmpHist = "$env:TEMP\edge_hist_copy.db"
    Copy-Item $histPath $tmpHist -Force -ErrorAction SilentlyContinue
    $raw = [System.IO.File]::ReadAllBytes($tmpHist) | ForEach-Object { [char]$_ }
    $rawStr = -join $raw
    foreach ($d in $BadDomains) {
        if ($rawStr -match [regex]::Escape($d)) {
            "[!] ALERT: Phishing domain '$d' present in Edge history database" | Out-File $ReportFile -Append
        }
    }
    Remove-Item $tmpHist -Force -ErrorAction SilentlyContinue
} else { "[i] Edge history not found — check Chrome/Firefox manually" | Out-File $ReportFile -Append }

"`n[5] Persistence Check (Run Keys / Recent Scheduled Tasks)`n-----------------------------------------------------------" | Out-File $ReportFile -Append
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
                 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
    Out-String | Out-File $ReportFile -Append
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-14)
} | Format-Table TaskName, TaskPath, Date | Out-String | Out-File $ReportFile -Append

"`n=== Hunt complete. If any [!] ALERT present: treat user as session-compromised — revoke Entra ID refresh tokens, reset credentials, review MFA methods and inbox rules. ===" | Out-File $ReportFile -Append
Write-Host "Report written to $ReportFile"