Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. According to ANY.RUN research, 48% of targeted email addresses were potentially compromised. Most of the affected companies are US-based. Mirage2FA Campaign
What happened
Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. According to ANY.RUN research, 48% of targeted email addresses were potentially compromised. Most of the affected companies are US-based. Mirage2FA Campaign
Why it matters
The incident may affect operational continuity, asset safety or trust around Microsoft. Watch for verified scope and remediation.
Affected entities
View evidence
2 reports · 1 original report · 1 independent
- The Hacker NewsPrimary source · Supports · EN · 100%Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows ↗
- The Hacker NewsPrimary source · Supports · EN · 49%NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions ↗
Claims
- Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows Observed
Conflicts
No material conflict detected in the available evidence.
Timeline
- First reported
Market move following event
Market reaction is not yet available for this asset and time window.