Mirage2FA: Phishing Kit That Walks Through MFA Prompts

Researchers at Fortra have lifted the lid on a phishing kit called Mirage2FA, and it is a neat piece of work. HTML smuggling, obfuscated JavaScript, a believable Microsoft 365 login clone, and a back end designed to grab multi-factor authentication codes while the victim is still typing them.

The bait is the usual office fare: remittance notices, automated billing, payment requests, secure documents. Open the HTML attachment and a Microsoft-branded page loads, styled as a protected business file. Nothing about it screams phishing to someone halfway through their inbox at 9am.

How it actually works

Behind the friendly page sits obfuscated JavaScript that decodes itself in stages: Base64, an XOR with 0xAD, a TextDecoder pass, then eval(). Once unpacked, it pulls a second-stage script from user.cheacker.store. The parent domain, cheacker.store, was registered on 16 March, which matches the disposable rhythm of modern phishing infrastructure. Spin it up, run the campaign, burn it down.

Stage two is where MFA stops being the comfortable safety net most people assume it is. The page throws up a fake CAPTCHA, then the credential prompt, then a live request for whatever second factor the victim normally uses. Authenticator app code. Number matching. SMS. The kit handles all of them, relays the code to the attacker, and the session is theirs.

What an attacker gets

A working Microsoft 365 account is rarely just an email account. Once they're in, the attacker has access to:

• Outlook mail and any historic correspondence worth mining
• SharePoint and OneDrive files
• Teams chats and channels
• Any OAuth-connected SaaS app that trusts the Microsoft identity

That is a wide blast radius from a single click on a dressed-up HTML attachment.

If someone in your org interacted with it

Fortra's recommended response is sensible and worth doing in order. Reset the user's password. Revoke active sessions and refresh tokens so any captured session is invalidated. Review enrolled MFA methods and remove anything unfamiliar. Check mailbox rules for the classic auto-forward or auto-delete tricks attackers drop in to hide their tracks. Audit OAuth grants for apps the user didn't add themselves.

For the perimeter side, the obvious IOCs to drop into blocklists are cheacker.store and user.cheacker.store.

The bit worth sitting with

MFA still matters. Removing it would be daft. But Mirage2FA, and the growing family of kits like it, makes one thing clear: the prompt itself is now part of the attack. The person staring at the approve button, half-distracted, mid-meeting, is where attackers have decided to spend their energy. They have worked out that the technical controls are tough, and the human at the end of the chain is more tractable.

Which is to say, the second factor still helps, but it is no longer the place the story ends.