Mirage2FA PhaaS Session Hijacking + BlackCore Influence-for-Hire: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Mirage2FA HTML Smuggling Attachment Dropped by Email Client or Browser
description: Detects HTML attachment write events consistent with Mirage2FA PhaaS HTML smuggling lures targeting Microsoft 365 credentials and sessions (LinX Coders).
id: 7a3f1c2e-9b41-4d5a-a1c2-mirage2fa0001
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
date: 2026/09/19
logsource:
    category: file_event
    product: windows
    definition: Requires Sysmon or equivalent file creation telemetry
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        TargetFilename|endswith:
            - '.html'
            - '.htm'
    selection_office:
        Image|endswith:
            - '\OUTLOOK.EXE'
        TargetFilename|endswith:
            - '.html'
            - '.htm'
    filter_downloads:
        TargetFilename|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
    condition: (selection_browser or selection_office) and filter_downloads
falsepositives:
    - Legitimate HTML report exports from SaaS applications
level: medium
tags:
    - attack.t1566.002
    - attack.t1027.006
---
title: WebSocket-Based AiTM Phishing Domain Resolution - Mirage2FA Infrastructure
description: Detects DNS queries to known Mirage2FA PhaaS infrastructure used for Adversary-in-the-Middle Microsoft 365 session hijacking via WebSocket relay.
id: 8b4e2d3f-0c52-5e6b-b2d3-mirage2fa0002
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
date: 2026/09/19
logsource:
    category: dns
    definition: Requires DNS query logging (firewall, resolver, or endpoint)
detection:
    selection:
        query:
            - 'galatasaraydanhaberler.com'
            - 'sopbtech.store'
            - 'office.pcvgtech.store'
            - 'ver.verpox.shop'
            - 'cementslabconstruction.com'
            - 'adp.pslcertlive.site'
            - 'ans.rsxbenefits.com'
            - 'ari.vslbertlive.info'
    condition: selection
falsepositives:
    - Unlikely; low-reputation TLD phishing infrastructure
level: high
tags:
    - attack.t1557
    - attack.t1539
    - attack.t1071.001
---
title: BlackCore Influence Operations Management Plane Access
description: Detects network connections to BlackCore influence-for-hire platform infrastructure, which may indicate targeting reconnaissance, insider engagement, or exposure to influence campaign tooling.
id: 9c5f3e4a-1d63-6f7c-c3e4-blackcore0003
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://citizenlab.ca/research/blackcores-influence-operations-for-hire/
date: 2026/09/19
logsource:
    category: proxy
    definition: Requires web proxy or secure web gateway logs
detection:
    selection:
        c-http-host|contains:
            - 'blackcore.online'
            - 'agitanews.net'
    condition: selection
falsepositives:
    - Threat intelligence research and attribution activity by security teams
level: medium
tags:
    - attack.t1583.001
    - attack.t1585.003

// Mirage2FA + BlackCore IOC and behavior hunt — Microsoft Sentinel
// Hunts network events to known AiTM phishing and influence-for-hire infrastructure,
// plus suspicious WebSocket connections from browsers to low-reputation TLDs.
let Mirage2FA_IOCs = dynamic([
    "galatasaraydanhaberler.com", "sopbtech.store", "office.pcvgtech.store",
    "ver.verpox.shop", "cementslabconstruction.com", "adp.pslcertlive.site",
    "ans.rsxbenefits.com", "ari.vslbertlive.info"
]);
let BlackCore_IOCs = dynamic([
    "blackcore.online", "agitanews.net", "angola-plan.blackcore.online",
    "api.blackcore.online", "auth.blackcore.online", "ava.blackcore.online",
    "demo.blackcore.online", "en.blackcore.online"
]);
let SuspiciousTLDs = dynamic([".store", ".shop", ".site", ".info"]);
union isfuzzy=true
    (
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (Mirage2FA_IOCs)
    | extend Campaign = "Mirage2FA"
    | project TimeGenerated, Campaign, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
    ),
    (
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (BlackCore_IOCs)
    | extend Campaign = "BlackCore"
    | project TimeGenerated, Campaign, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
    ),
    (
    // Behavioral: browser-initiated connections to suspicious TLDs followed by M365 auth
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
    | where RemoteUrl matches regex @"(?i)(office|login|adp|benefits|verify|secure)[^/]*\.(store|shop|site|info)$"
    | extend Campaign = "Behavioral-AiTM-Suspect"
    | project TimeGenerated, Campaign, DeviceName, InitiatingProcessFileName,
              RemoteUrl, RemoteIP, ActionType
    )
| sort by TimeGenerated desc

# Mirage2FA / BlackCore IOC Hunt Script — Security Arsenal
# Checks DNS cache, hosts file, and established connections for known indicators.
# Run elevated on endpoints or via your RMM/EDR remote shell at fleet scale.

$mirage2fa = @(
    'galatasaraydanhaberler.com','sopbtech.store','office.pcvgtech.store',
    'ver.verpox.shop','cementslabconstruction.com','adp.pslcertlive.site',
    'ans.rsxbenefits.com','ari.vslbertlive.info'
)
$blackcore = @(
    'blackcore.online','agitanews.net','angola-plan.blackcore.online',
    'api.blackcore.online','auth.blackcore.online','ava.blackcore.online',
    'demo.blackcore.online','en.blackcore.online'
)
$allIOCs = $mirage2fa + $blackcore
$hits = @()

Write-Host "[*] Checking DNS client cache..." -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | ForEach-Object {
    foreach ($ioc in $allIOCs) {
        if ($_.Entry -like "*$ioc*") {
            $hits += [PSCustomObject]@{Source='DNSCache'; Indicator=$ioc; Detail=$_.Entry; Data=$_.Data}
        }
    }
}

Write-Host "[*] Checking hosts file for tampering..." -ForegroundColor Cyan
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $hostsPath) {
    $hostsContent = Get-Content $hostsPath -ErrorAction SilentlyContinue
    foreach ($ioc in $allIOCs) {
        $match = $hostsContent | Select-String -Pattern ([regex]::Escape($ioc))
        if ($match) { $hits += [PSCustomObject]@{Source='HostsFile'; Indicator=$ioc; Detail=$match.Line; Data=''} }
    }
}

Write-Host "[*] Checking active network connections to suspicious TLDs..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $conn = $_
    try {
        $resolved = ([System.Net.Dns]::GetHostEntry($conn.RemoteAddress)).HostName
        foreach ($ioc in $allIOCs) {
            if ($resolved -like "*$ioc*") {
                $proc = (Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue).ProcessName
                $hits += [PSCustomObject]@{Source='NetConnection'; Indicator=$ioc; Detail=$resolved; Data="$proc -> $($conn.RemoteAddress):$($conn.RemotePort)"}
            }
        }
    } catch {}
}

Write-Host "[*] Checking for suspicious inbox-rule staging artifacts (recent OST/profile changes)..." -ForegroundColor Cyan
# AiTM compromise often precedes BEC; flag recently created Outlook rules via registry
$rulesKey = "HKCU:\Software\Microsoft\Office\16.0\Outlook\Profiles"
if (Test-Path $rulesKey) {
    Write-Host "    [i] Outlook profile present — recommend mailbox audit via Graph API for new inbox rules and MFA method changes."
}

if ($hits.Count -gt 0) {
    Write-Host "`n[!] INDICATORS FOUND:" -ForegroundColor Red
    $hits | Format-Table -AutoSize
    $hits | Export-Csv -Path ".\ioc_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host "`n[+] No indicators found on this host." -ForegroundColor Green
}