Mir0Auth is a phishing kit designed to steal Microsoft 365 authentication tokens by leveraging a multi-stage attack chain. The attack begins with a phishing email containing a PDF that leads to a DocuSign-themed landing page. This page then redirects victims to a legitimate Microsoft Device Code authentication page (microsoft.com/devicelogin) in a popup, where the victim signs in. Meanwhile, Mir0Auth manages session state and communication through source-code-like endpoints (/task_queue.cs, /context.go, /window.rs) with obfuscated network traffic using XOR encoding for both URLs and JSON payloads. The attacker’s session receives the M365 tokens after victim authentication. The campaign has been primarily observed targeting organizations in the United States.

Successful exploitation results in attackers obtaining valid Microsoft 365 authentication tokens, potentially allowing unauthorized access to victim M365 accounts and associated resources. This can lead to data theft, account compromise, and further lateral movement within targeted organizations. The use of legitimate Microsoft authentication pages may increase the likelihood of victim trust and successful credential theft.

No official patch or fix is applicable as this is a phishing campaign rather than a software vulnerability. Organizations should focus on user awareness training to recognize phishing lures, implement multi-factor authentication (MFA) for Microsoft 365 accounts, and monitor for suspicious authentication activity. Blocking or monitoring the identified obfuscated endpoints and network patterns may aid detection. Since this is an active phishing kit, proactive threat intelligence subscription and IOC tracking are recommended.