A phishing-as-a-service kit sold by a crew calling itself LinX Coders steals the one thing a password reset can’t fix — the live session cookie — and ANY.RUN’s telemetry ties it to 9,332 compromise events reaching 94 countries.
For most defenders, a phishing alert ends with a forced password change. Mirage2FA is built to make that response useless.
The phishing-as-a-service kit documented by ANY.RUN threat intelligence analysts ShiFu and raptur3 does not just harvest passwords; it sits between the victim and Microsoft as an adversary-in-the-middle (AiTM) proxy, forwards the login and 2FA code in real time, and walks away with the authenticated session cookie Microsoft hands back. With that cookie replayed, the attacker is already inside no password, no second factor required.
That design has scaled. ANY.RUN links the campaign to 4,532 potentially compromised accounts across 3,518 organizations, roughly 48% of the 9,426 email addresses it saw targeted, and to 9,332 discrete compromise events logged across 94 countries.
Why the Session Cookie Is the Real Prize
The breakdown of what Mirage2FA actually steals tells the story. Of the 9,332 recorded compromise events, 4,561 — about 51% — were session-cookie thefts affecting 2,541 unique victims.
Password-and-2FA captures accounted for 3,044 events (34%), single sign-on logins for 1,339 (15%), and a further 388 fell into other categories.
The kit dumps those stolen cookies as Base64-encoded .txt files on its operator panel, ready for replay against Microsoft 365, connected SSO apps, and internal workflows.
Because a valid session survives a password change, containment has to be treated as an identity incident: every active session and token revoked, mail-forwarding rules and OAuth grants reviewed, and each action taken through the hijacked account audited.
A third of successful logins (33.3%) came from mobile devices, where a phishing page is far harder to spot.
Get a full version of the Mirage2FA report for SOC and MSSP teams. A complete list of IOCs for your SIEM/EDR.
A US-Heavy Campaign Aimed at Tech and Manufacturing
Victim activity spans 94 countries, but the United States absorbs the bulk of it: 2,885 victims, or 63.7% of the total, ahead of India (5.1%), Singapore (4.1%), the United Kingdom (1.7%), and Canada (1.7%).
By sector, technology firms lead at 19.2%, followed by manufacturing (11.1%), education (9.9%), consulting (8.3%), telecommunications (6.6%), healthcare (5.4%), and finance (3.1%).
Managed security service providers sit among the most-affected group as well — a single hijacked MSSP identity can cascade into the customers it protects.
The operator has been running since at least September 2024, but volume jumped in 2026. Sandbox detections climbed steadily from March, and July alone logged 445 Mirage2FA sessions with the month only partly captured out of 1,249 sessions ANY.RUN analyzed overall.
Lower the cost of account compromise with early detection. Prevent a business incident with proactive defense.
Inside the Attack: No Binary, Just a Browser
Mirage2FA never drops an executable. The chain starts with a phishing email often disguised as an HR or 401(k) benefits notice and blasted out through Amazon SES (MITRE ATT&CK T1566.001/.002) carrying a .htm, .xhtml, or .svg attachment, or a QR code that pushes the victim to open the link on a phone.
Opening the file runs an embedded stager in the browser (T1204.002). It carries a per-recipient token the victim’s email, Base64-encoded into a placeholder the operator calls LINXB64EMAIL and reaches out to a remote loader using a /xls/<token>.js path (T1105).
In ANY.RUN’s sandbox the attachment throws up a “Verify you’re human” slider, then a Microsoft-styled password prompt with the victim’s address pre-filled, while the network log shows the loader pulled from user.cheacker[.]store, a WebSocket opening to the C2, a POST to an xwps.php handler, and an api.ipify.org lookup fingerprinting the victim.
From there the proxy relays the credentials and one-time code to the real Microsoft endpoint over the WebSocket channel (T1557, T1111). Microsoft authenticates, the proxy pockets the resulting session, and both cookie and credentials are exfiltrated (T1539) for reuse against the victim’s mailbox and identity (T1071.001).
Across the 1,249 sandbox runs the recurring behaviors were phishing, obfuscated JavaScript, WebSocket AiTM traffic, IP and browser fingerprinting, QR-code delivery, and Amazon SES activity.
See the full attack chain in <60 sec. Reduce investigation time before account compromise turns into a larger incident.
Six Ways to Hide the Same Loader
ANY.RUN pulled apart 629 .htm samples (453 obfuscated), 198 XHTML samples (31 obfuscated), and 187 SVG samples (12 obfuscated) — no binary malware among them. The plainest .htm is a two-line stub that sets a uid token and fetches /api/xls/a1p2i.js.
The clean XHTML variant spins up a full-screen iframe, writes a document into it, and injects the same loader, taking its token from a ?ref= parameter.
Its obfuscated sibling buries the same behavior behind a hex-to-string decoder, rsy(), reading the token from ?sdv= or the URL fragment.
The obfuscated .htm is fully self-contained: it Base64-decodes a blob, XORs each byte against key 0xAD (173), and hands the result to eval().
The SVG stagers abuse an inline <script> in a standalone SVG to redirect the browser straight to the phishing URL, token in the query string; a dozen wrap that redirect in an obfuscator.io-style string-array decoder to hide where it points.
Following the Infrastructure Back to LinX Coders
The loader and C2 traffic converge on 185.174.100.224, hosted on AS-Colocrossing, serving domains such as user.cheacker[.]store, hvr.volatilesour[.]store, ver.bandhiem[.]com, and pynutech[.]store.
Every loader request follows the same shape — https://<host>/<3-letter-code>/xls/<token>.js, with codes like api, ulr, eor, pxk, dsk, and tsk and token suffixes c2v or cpt — and querying that pattern in ANY.RUN’s Threat Intelligence Lookup unrolled a whole cluster of related URLs on the same address.
The researchers pin the kit on a crew branding itself LinX Coders. The tells: the LINXCODERSEMAIL substitution placeholder, Telegram bots named linxlogsss…bot and linxxlogss…bot, and a channel called LinXcoded that openly markets a “LinX Sender,” a “2FA Cookies Attachment/Link,” and a “LinXMail Token Link App.”
Operator test messages came from IPs in the same 185.174.100.0/24 subnet as the production C2, build markers walked from LINXCODERSEMAIL to LINXEMAIL to LINXB64EMAIL, and the newest test — a login with the password linxz — landed on July 3, 2026.
ANY.RUN cautions that the panel’s self-logged IP and geo data can reflect VPNs or spoofing; the sturdier signal is address reuse across multiple bots and the subnet overlap with infrastructure it observed independently, and a single bot ID stitches the 2024–2025 tests to the 2026 lures.
Over that span the kit graduated from plain loaders to XOR, hex, and obfuscator.io wrappers, added new /xls/ routes and token variants, and rotated domains.
Closing the Gap: Defenses That Actually Bite
Because Mirage2FA defeats conventional MFA, the fixes have to go further. ANY.RUN advises blocking or quarantining .htm, .xhtml, and .svg attachments at the gateway, adding detections for HTML smuggling and obfuscated JavaScript, and treating QR-code lures and Amazon SES mail as suspect.
High-value users admins, executives, finance should move to phishing-resistant MFA such as FIDO2/WebAuthn keys or passkeys, reinforced by shorter session lifetimes, token binding, and Continuous Access Evaluation in Microsoft Entra ID.
For threat hunters, the report points to signatures that survive infrastructure churn:
- Loader requests matching /[a-z]{3}/xls/[a-z0-9]+(?:c2v|cpt)?\.js, canonical form /api/xls/a1p2i.js
- DNS lookups where a Base64-encoded email appears as the subdomain label of cheacker[.]store
- A WebSocket opening to an unfamiliar host right after a JavaScript loader is fetched
- HTML attachments running atob(…).map(x => x.charCodeAt(0) ^ 173) into eval(…)
- SVGs carrying an inline <script type=”application/ecmascript”> that fires a window.location redirect
- LINX* placeholder strings and page variables such as uid, self.u, and RSTRING2
Expand threat coverage in your SOC. Integrate 99% unique TI Feeds based on live threat data from 16K companies.
Selected Indicators of Compromise
| Type | Indicator |
| C2 / loader IP | 185.174.100.224 (AS-Colocrossing) |
| Loader domains | user.cheacker[.]store, hvr.volatilesour[.]store, ver.bandhiem[.]com, pynutech[.]store |
| Phishing domains (sample) | pectech[.]store, bns.baseasix[.]com, adp.pslcertlive[.]site, office.pcvgtech[.]store, hpn.bandhiem[.]com, vrf.iar0nline[.]com, ans.rsxbenefits[.]com |
| Loader path | /<3-letter-code>/xls/<token>.js (canonical: /api/xls/a1p2i.js) |
| Build markers | LINXB64EMAIL, LINXEMAIL, LINXCODERSEMAIL, LINXCODERSRANDSTRING, #LINXMASKEMAIL, #LINXRANDSTRING, linxz |
| Obfuscation key | XOR 0xAD (173) + Base64 + eval |
| Activity window | September 2024 – July 2026 (observed) |
ANY.RUN’s full report carries the complete set of 60-plus phishing domains and 21 operator testing IP addresses.
