Mirage2FA phishing kit employs HTML smuggling combined with obfuscated JavaScript loaders to deliver fake Microsoft 365 login pages designed to steal credentials during multi-factor authentication (MFA) prompts. The attack begins with an email containing an HTML and JavaScript attachment that launches a Microsoft-branded page resembling a protected business document. The initial payload uses Base64 encoding, XOR with 0xAD, TextDecoder, and eval() to decode and execute concealed code that loads a second-stage phishing script from attacker-controlled domains (cheacker.store and user.cheacker.store). The second-stage page mimics Microsoft 365's sign-in process, including fake CAPTCHA and prompts for multiple MFA methods such as authenticator apps and number matching, with code also supporting SMS verification. The campaign aims to enable Microsoft 365 account takeover, potentially granting attackers access to email, files, Teams messages, SharePoint, and other connected SaaS resources. Indicators of compromise include the domains cheacker.store and user.cheacker.store, an IP address, and JavaScript resources identified by Fortra researchers.

Successful exploitation can lead to Microsoft 365 account takeover, allowing attackers to access sensitive email communications, files, Teams messages, SharePoint content, and other connected SaaS resources. This compromises organizational security and data confidentiality. The phishing kit's use of MFA prompts increases the likelihood of bypassing multi-factor authentication protections.

No official patch is applicable as this is a phishing attack technique. Users who have interacted with the phishing page or submitted credentials should immediately reset their passwords, revoke active sessions and refresh tokens, review MFA methods, inspect mailbox rules, and check OAuth grants for unauthorized access. Organizations should educate users about phishing risks, especially those involving MFA prompts, and monitor for indicators of compromise such as the domains cheacker.store and user.cheacker.store. Employing email filtering and anti-phishing solutions can help reduce exposure.