Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. According to ANY.RUN research, 48% of targeted email addresses were potentially compromised. Most of the affected companies are US-based. Mirage2FA Campaign
Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor’s use of npm isn't to infect developers who install it, but to use the
ReliaQuest confirmed that one of its employees fell victim to a social engineering attack that provided attackers with a password and temporary access to the company's identity system. Extortion group ShinyHunters subsequently posted screenshots on its leak site, claiming responsibility and taunting the cybersecurity firm over the breach. The incident followed an earlier exchange between ShinyHunters and ReliaQuest's threat research team on social media.
Scammers are leveraging fake TikTok login pages and fraudulent verification alerts to deceive users into revealing their account credentials. Security professionals should be aware of this phishing campaign targeting TikTok users, as attackers use convincing replicas of official login and verification interfaces to compromise accounts.
Attackers are deploying counterfeit Microsoft security scanners that fabricate threats and convince users to disable their legitimate antivirus software, leaving systems vulnerable to further compromise. Once victims uninstall their protections, the scammers redirect them into refund fraud schemes, exploiting the deception to extract payment.