Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials

1. Executive summary

Fortra researchers have identified "Mirage2FA," a phishing kit that uses short-lived HTML smuggling and obfuscated JavaScript loaders to deliver fake Microsoft 365 login pages and harvest credentials and MFA tokens from victims. The campaign targets business users with financial-themed lures (remittance services, automated billing, payment requests) and aims at Microsoft 365 account takeover, granting attackers access to email, files, Teams messages, SharePoint, and connected SaaS resources. EMEA financial services organisations are directly exposed given the payment- and billing-themed social engineering. No verified reference data (CVSS, CISA-KEV) was resolved for this item; attribution is to Fortra research and is single-sourced.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps from Fortra analysis)

1. Initial delivery: Victim receives an email containing an HTML attachment with a business-themed lure (secure documents, remittance services, automated billing, payment requests).
2. HTML smuggling execution: Opening the HTML attachment launches a Microsoft-branded page designed to resemble a protected business document. The initial HTML payload uses obfuscated JavaScript to hide its behaviour from static inspection.
3. Deobfuscation and execution: The obfuscated JavaScript is decoded and executed using a chain of: Base64 decoding, XOR with key 0xAD, TextDecoder, and eval().
4. Second-stage loading: The decoded code loads a second-stage script from attacker-controlled infrastructure at user[.]cheacker[.]store.
5. Phishing page render: The second-stage page mimics the Microsoft 365 sign-in process, presenting a fake CAPTCHA screen, credential fields, and prompts for multiple MFA methods including authenticator apps and number matching. Code supporting SMS verification was also present, though Fortra did not confirm that workflow during testing.
6. Credential and MFA theft: If the user submits credentials and completes MFA prompts, the attacker captures both. The likely goal is Microsoft 365 account takeover.
7. Post-compromise access: With stolen credentials and completed MFA, the attacker may access email, files, Teams messages, SharePoint content, and other connected SaaS resources.

Technical specifics

• Domain infrastructure: cheacker[.]store was registered on March 16, suggesting purpose-built, short-lived infrastructure. Second-stage script hosted at user[.]cheacker[.]store.
• Obfuscation chain: Base64 → XOR (key 0xAD) → TextDecoder → eval(). This is a multi-layer evasion technique designed to defeat static analysis and email gateway inspection.
• MFA interception: The phishing page supports multiple MFA methods — authenticator app approvals, number matching, and SMS verification (unconfirmed). This indicates the kit is designed to defeat modern MFA, not just basic password capture.
• No confirmed CVE: This is a social-engineering-driven attack; no software vulnerability exploitation is described. No CVSS scores or CISA-KEV entries apply.

Confidence caveat: This analysis is single-sourced, based solely on Fortra's research as reported by Help Net Security. No independent corroboration was available at time of writing. The SMS verification workflow is unconfirmed by Fortra. Attribution to a specific threat actor is not claimed by the source; no MITRE profile is referenced. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Block domains: Add cheacker[.]store and user[.]cheacker[.]store to DNS blocklists, email gateway filters, web proxy blocklists, and SIEM threat-intelligence feeds.
• Block IP: Block the IP address identified by Fortra (see §5) at firewall, proxy, and EDR network rules.
• Hunt for HTML attachments: Search mailboxes and endpoint telemetry for .html / .htm attachments delivered via email, particularly those referencing business themes (remittance, billing, payment, secure document). Quarantine matching messages.
• Hunt for obfuscation pattern: Search endpoint and email gateway logs for HTML/JS content containing eval() combined with TextDecoder and XOR patterns. These are distinctive to this kit.
• Identify victims: Cross-reference proxy/DNS logs for any internal host that resolved cheacker[.]store or user[.]cheacker[.]store. Any match is a likely compromise.

P2 — Within 72 hours

• For any user who opened the phishing page or submitted information: Reset password; revoke all active sessions and refresh tokens; review MFA methods (remove any not recognised by the user); inspect mailbox rules (look for forwarding, deletion, or hiding rules); check OAuth grants (revoke any unrecognised app consents).
• Conditional Access hardening: Enforce Conditional Access policies requiring compliant device + compliant location for M365 sign-in. This raises the bar for token-replay from attacker infrastructure.
• Email gateway rules: Create rules to quarantine or block .html / .htm attachments from external senders, particularly those with financial-themed subject lines.

P3 — Within 7 days

• User awareness: Brief finance, accounts, and treasury teams on the specific lures used (remittance services, automated billing, payment requests). These departments are the primary targeting profile.
• MFA phishing-resistant rollout: Evaluate rollout of phishing-resistant MFA (FIDO2 / Windows Hello for Business) which cannot be relayed through adversary-in-the-middle phishing pages.
• Threat-intelligence feed update: Ensure cheacker[.]store and associated IOCs are pushed to all security tooling (EDR, SIEM, email security, web gateway, DNS filtering).

5. Indicators of compromise

Note: Fortra stated they identified "an IP address" but the specific value was not included in the available source material. Do not infer or fabricate the IP. The JavaScript resources mentioned were not individually enumerated in the source.

domain  cheacker[.]store
domain  user.cheacker[.]store

6. Detection

rule Mirage2FA_HTML_Smuggling_Loader {
    meta:
        author = "Adverse Trace"
        date = "2026-06-26"
        reference = "https://www.helpnetsecurity.com/2026/06/26/mirage2fa-phishing-kit-microsoft-365-html-smuggling/"
        description = "Detects Mirage2FA phishing kit HTML smuggling payload with obfuscated JavaScript loader"
    strings:
        $xor_key = "0xAD" ascii
        $textdecoder = "TextDecoder" ascii
        $eval = "eval(" ascii
        $base64 = "Base64" ascii
        $cheacker = "cheacker.store" ascii
        $m365_signin = "Microsoft 365" ascii
        $captcha = "CAPTCHA" ascii nocase
    condition:
        (3 of ($xor_key, $textdecoder, $eval, $base64)) and (1 of ($cheacker, $m365_signin, $captcha))
}

title: Detect Mirage2FA Phishing Kit Domain Resolution
id: at-2026-06-26-185-dns
status: experimental
description: Detects DNS resolution of Mirage2FA phishing kit infrastructure
author: Adverse Trace
date: 2026/06/26
references:

    - https://www.helpnetsecurity.com/2026/06/26/mirage2fa-phishing-kit-microsoft-365-html-smuggling/
logsource:
    product: dns
    category: dns_query
detection:
    selection:
        query|contains:

            - "cheacker.store"
            - "user.cheacker.store"
    condition: selection
falsepositives:

    - Unlikely — domain registered March 16 for short-lived campaign
level: high

title: Detect Mirage2FA HTML Attachment in Email
id: at-2026-06-26-185-email
status: experimental
description: Detects HTML attachments with financial-themed lures consistent with Mirage2FA campaign
author: Adverse Trace
date: 2026/06/26
references:

    - https://www.helpnetsecurity.com/2026/06/26/mirage2fa-phishing-kit-microsoft-365-html-smuggling/
logsource:
    product: email
    category: email_attachment
detection:
    selection_attachment:
        filename|endswith:

            - ".html"
            - ".htm"
    selection_lure:
        subject|contains:

            - "remittance"
            - "billing"
            - "payment"
            - "secure document"
    condition: selection_attachment and selection_lure
falsepositives:

    - Legitimate business email with HTML attachment and financial subject
level: medium

7. Sources

• Help Net Security — "Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials" — https://www.helpnetsecurity.com/2026/06/26/mirage2fa-phishing-kit-microsoft-365-html-smuggling/ — 2026-06-26
• Help Net Security — "New Browser-in-the-Browser phishing uses fake login popups to steal Microsoft 365 credentials" (context only — separate campaign) — https://www.helpnetsecurity.com/2026/06/10/browser-in-the-browser-phishing-microsoft-365-users/ — 2026-06-10

8. Adverse Trace position

Severity: — active phishing campaign targeting Microsoft 365 credentials with financial-themed lures directly relevant to EMEA financial services. No CVE or CISA-KEV entry applies; this is a social-engineering and credential-theft threat, not a software vulnerability. Client impact: High for organisations with Microsoft 365 tenants and staff in finance, accounts, or treasury functions — the lures are tailored to those roles. The multi-MFA-method interception (authenticator, number matching, potentially SMS) means standard MFA alone is insufficient defence. Confidence caveat: Single-sourced to Fortra research; no independent corroboration available at time of writing. Attribution to a specific threat actor is not claimed. The IP address IOC was referenced but not enumerated in the source — verify with Fortra's original publication before adding to blocklists. Next steps: Adverse Trace will monitor for corroborating reports, additional IOCs (particularly the unspecified IP and JavaScript resource URLs), and any follow-on activity from the cheacker[.]store infrastructure. We will escalate to if active exploitation against client environments is confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.