Mirage2FA PhaaS Kit: Microsoft 365 Session Hijacking via AiTM — OTX Pulse Analysis & Detection Pack

Threat Summary

Live OTX pulse data confirms an active, industrialized phishing-as-a-service (PhaaS) operation branded Mirage2FA, attributed to the LinX Coders threat actor group. The campaign targets Microsoft 365 tenants using Adversary-in-the-Middle (AiTM) proxy techniques to steal not just credentials, but fully authenticated session tokens — effectively bypassing MFA protections that organizations rely on as their primary defense against credential phishing.

The victimology is significant: over 4,000 confirmed compromise events in the United States (63.7% of identified victims), with spillover into Canada, the UK, India, Saudi Arabia, Singapore, and South Africa. Targeted verticals span Technology, Manufacturing, Education, Finance, Healthcare, and Telecommunications — a classic broad-net PhaaS distribution model where the kit is sold or rented to multiple downstream affiliates.

The attack chain is consistent with modern AiTM tooling:

1. Lure delivery — Phishing emails impersonating Microsoft 365, HR/benefits portals (note indicators like adp.pslcertlive.site and ans.rsxbenefits.com spoofing ADP and benefits platforms), or document-sharing notifications.
2. HTML smuggling — Malicious HTML attachments or links deliver the phishing payload client-side, evading email gateway inspection.
3. AiTM reverse proxy — The victim interacts with a pixel-perfect Microsoft login proxy hosted on actor infrastructure. Credentials, MFA codes, and the resulting session cookie are harvested in real time.
4. WebSocket exfiltration — Captured session material is relayed to the operator over WebSocket channels, enabling near-real-time session replay.
5. Session replay & persistence — Stolen session tokens are replayed to access Exchange Online, SharePoint, and Teams; actors commonly register their own MFA methods or create inbox rules to maintain access.

The objective is credential and session theft at scale — feeding downstream business email compromise (BEC), data exfiltration, and initial access brokerage.

Threat Actor / Malware Profile

Actor: LinX Coders — a PhaaS developer/operator group distributing Mirage2FA to affiliate phishers. The PhaaS model means infrastructure, lures, and targeting vary by affiliate, but the core kit behavior is consistent.

Mirage2FA Kit Characteristics:

• Distribution: Phishing emails with HTML attachments (HTML smuggling) or embedded links; lures themed around Microsoft 365 quota alerts, HR benefits enrollment (ADP impersonation), voicemail notifications, and shared documents.
• Payload behavior: The phishing page acts as a transparent reverse proxy to the genuine Microsoft login endpoint. The victim completes the full authentication flow — including MFA — while the proxy intercepts credentials, one-time codes, and the post-authentication session cookie.
• C2 communication: Stolen session data is exfiltrated to operator panels over WebSocket connections, allowing operators to watch victims authenticate live and capture tokens the moment they are issued. This distinguishes Mirage2FA from static credential harvesters.
• Persistence: No host-based persistence — persistence is identity-layer. After session theft, actors typically register attacker-controlled MFA devices, add mail forwarding/delegation rules in Exchange Online, and abuse OAuth consent for durable access.
• Anti-analysis techniques: HTML smuggling to bypass email content inspection, rotating throwaway domains on low-reputation TLDs (.store, .shop, .site, .info), anti-bot/anti-sandbox checks that redirect scanners to benign pages, and subdomain-per-victim patterns (e.g., office.pcvgtech.store) to defeat static URL blocking.

IOC Analysis

The pulse contains 68 indicators, dominated by domains and hostnames — the phishing proxy infrastructure. Key patterns:

• Low-reputation TLDs: .store, .shop, .site, .info — cheap, fast-flux friendly registrations typical of PhaaS affiliate infrastructure.
• Brand-spoofing subdomains: office.pcvgtech.store, adp.pslcertlive.site, ans.rsxbenefits.com — subdomain keywords (office, adp, ver, ans, ari) designed to look like legitimate enterprise services in the browser address bar.
• Compromised/typosquat legitimate-looking domains: galatasaraydanhaberler.com, cementslabconstruction.com — likely compromised or aged domains used to improve deliverability and evade domain-age filters.

Operationalization guidance for SOC teams:

• Push domains/hostnames to DNS sinkhole, proxy, and email gateway blocklists immediately. Block at the parent-domain level (*.pcvgtech.store) to catch subdomain rotation.
• Pivot on TLD + naming pattern in DNS query logs — the kit's structure makes sibling domains highly likely.
• In Microsoft 365 Defender / Entra ID, hunt for sign-ins from anomalous ASNs and impossible-travel events coinciding with clicks to these domains — session replay is the real payload.
• Detonate suspicious HTML attachments in ANY.RUN or similar sandboxes to extract redirected phishing URLs and WebSocket endpoints for additional indicator harvesting.

Detection Engineering

---
title: Mirage2FA AiTM Phishing Infrastructure DNS Resolution
id: 8f3a1c2e-7b41-4d9a-a1e2-mirage2fa001
status: experimental
description: Detects DNS resolution of known Mirage2FA AiTM phishing proxy domains and hostnames identified in OTX pulse. Indicates user clicked phishing lure and reached the credential/session theft proxy.
author: Security Arsenal Threat Intel
logsource:
  category: dns
product: windows
service: dns-client
detection:
  selection_domain:
    QueryName|contains:
      - 'galatasaraydanhaberler.com'
      - 'sopbtech.store'
      - 'pcvgtech.store'
      - 'verpox.shop'
      - 'cementslabconstruction.com'
      - 'pslcertlive.site'
      - 'rsxbenefits.com'
      - 'vslbertlive.info'
  condition: selection_domain
falsepositives:
  - Threat intelligence validation traffic
level: high
date: 2026/09/19
---
title: HTML Smuggling Attachment Execution From Browser or Email Client
id: 8f3a1c2e-7b41-4d9a-a1e2-mirage2fa002
status: experimental
description: Detects HTML file execution from browser download or Outlook temp directories consistent with Mirage2FA HTML smuggling delivery of AiTM phishing lures.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\OUTLOOK.EXE'
  selection_path:
    CommandLine|contains:
      - '\Downloads\'
      - 'Content.Outlook'
      - '\INetCache\'
  selection_ext:
    CommandLine|endswith:
      - '.html'
      - '.htm'
  condition: selection_img and selection_path and selection_ext
falsepositives:
  - Legitimate HTML reports or exports opened from Downloads
level: medium
date: 2026/09/19
---
title: Suspicious WebSocket Connection From Browser To Low-Reputation TLD
id: 8f3a1c2e-7b41-4d9a-a1e2-mirage2fa003
status: experimental
description: Detects browser-initiated network connections to phishing-associated TLDs (.store, .shop, .site, .info) consistent with Mirage2FA WebSocket-based session exfiltration to operator panels.
author: Security Arsenal Threat Intel
logsource:
  category: network_connection
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  selection_tld:
    DestinationHostname|endswith:
      - '.store'
      - '.shop'
      - '.site'
      - '.info'
  condition: selection_img and selection_tld
falsepositives:
  - Legitimate small-business sites on low-cost TLDs
level: medium
date: 2026/09/19

// Mirage2FA AiTM phishing infrastructure hunt — network + identity correlation
let PhishDomains = dynamic(["galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop","cementslabconstruction.com","pslcertlive.site","rsxbenefits.com","vslbertlive.info"]);
let NetworkHits = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (PhishDomains)
| project NetworkTime=Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP;
NetworkHits
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName in~ ("msedge.exe","chrome.exe","firefox.exe","OUTLOOK.EXE")
    | project ProcessTime=Timestamp, DeviceName, FileName, ProcessCommandLine
) on DeviceName
| where ProcessTime between (datetime_add('minute',-5,NetworkTime) .. NetworkTime)
| project NetworkTime, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ProcessCommandLine
| order by NetworkTime desc
// Corroborate with identity layer: check SigninLogs in Sentinel for anomalous
// sign-ins (new ASN, impossible travel, token replay) for users on hit devices.

# Mirage2FA AiTM Hunt Script — Security Arsenal
# Checks for phishing page artifacts, suspicious WebSocket-era connections, and M365 persistence remnants
$PhishDomains = @("galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop","cementslabconstruction.com","pslcertlive.site","rsxbenefits.com","vslbertlive.info")

Write-Host "[1] DNS cache check for Mirage2FA phishing infrastructure..." -ForegroundColor Cyan
$dnsHits = Get-DnsClientCache | Where-Object { $d = $_.Entry; $PhishDomains | Where-Object { $d -like "*$_*" } }
if ($dnsHits) { $dnsHits | Format-Table Entry, Data, Status -AutoSize } else { Write-Host "  No phishing domains in DNS cache." }

Write-Host "[2] Active browser connections to low-reputation TLDs..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
    $_.OwningProcess -in (Get-Process msedge,chrome,firefox -ErrorAction SilentlyContinue).Id
} | ForEach-Object {
    try {
        $r = Resolve-DnsName $_.RemoteAddress -ErrorAction Stop | Select-Object -First 1 -ExpandProperty NameHost
        if ($r -match '\.(store|shop|site|info)$') { "  [ALERT] $($_.RemoteAddress) -> $r" }
    } catch {}
}

Write-Host "[3] Recently downloaded HTML files (HTML smuggling artifacts)..." -ForegroundColor Cyan
$dl = "$env:USERPROFILE\Downloads"
Get-ChildItem $dl -Include *.html,*.htm -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
  Format-Table FullName, CreationTime -AutoSize

Write-Host "[4] Suspicious Outlook temp execution artifacts..." -ForegroundColor Cyan
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Windows\INetCache\Content.Outlook" -Recurse -Include *.html,*.htm -ErrorAction SilentlyContinue |
  Format-Table FullName, LastWriteTime -AutoSize

Write-Host "[5] REMINDER: For any host with hits, review Entra ID sign-in logs for anomalous auth,`n     new MFA method registrations, and Exchange inbox forwarding rules." -ForegroundColor Yellow

Response Priorities

Immediate (0–4 hours):

• Block all 68 IOC domains/hostnames at DNS, web proxy, and email gateway; block parent domains to preempt subdomain rotation.
• Hunt DNS and proxy logs for the past 30 days for any resolution of indicator domains — every hit is a probable session compromise.
• For any user who visited phishing infrastructure: revoke all active sessions and refresh tokens in Entra ID immediately (password reset alone does NOT invalidate stolen session cookies).

24 hours:

• Force credential resets and MFA re-registration for affected users; audit for attacker-added MFA methods, inbox forwarding rules, and OAuth app consents.
• Review Exchange Online mail flow and SharePoint/OneDrive access logs for affected identities for BEC staging or data staging.
• Notify targeted executives/finance staff — BEC follow-on is the most common monetization path.

1 week:

• Deploy phishing-resistant MFA (FIDO2/passkeys) for privileged and finance roles — AiTM kits defeat SMS, TOTP, and push-based MFA but cannot proxy hardware-bound passkeys.
• Enable conditional access token binding / compliant-device requirements so replayed session cookies fail from attacker infrastructure.
• Tighten email gateway rules for HTML attachments; enable Defender for Office 365 detonation of HTML smuggling payloads; add TLD-based web filtering policy for .store/.shop/.site categories where business-justified.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub