Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US

Reported 18 Aug 2026 by otx · Severity: medium

Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle attacks. Analysis shows 63.7% of identified victims are in the US, with Technology, Manufacturing, and Education among the most