Researchers at Fortra recently analyzed a phishing framework they named Mirage2FA, a highly evasive kit built specifically to steal Microsoft 365 multifactor authentication (MFA) credentials. Unlike traditional phishing campaigns that simply redirect users to fake login pages, Mirage2FA introduces a more technically advanced delivery mechanism built around obfuscated HTML files that execute malicious phishing logic directly inside the victim’s browser.The campaign reinforces a reality that defenders continue to underestimate. Many sophisticated credential theft operations still begin with a malicious file delivered to the endpoint before any network based phishing detection system has a chance to intervene.
How Mirage2FA Works
The attack chain begins with the delivery of a seemingly harmless HTML attachment, distributed through phishing emails built around business themed lures. Fortra observed messages framed as secure documents, remittance notices, automated billing, and payment requests, all designed to look like routine Microsoft 365 or document sharing notifications.
Rather than directing victims to a suspicious URL right away, Mirage2FA relies on a locally executed HTML loader. When the victim opens the file, heavily obfuscated JavaScript embedded inside the HTML document begins decoding itself directly in the browser runtime. The script reconstructs the phishing interface locally, which means much of the phishing logic never initially resides on a remote webpage where secure web gateways or URL reputation engines could immediately flag it.
Inside the loader. Fortra found that the initial HTML payload used layered obfuscation to hide its behavior from static inspection. The concealed code was decoded and executed using Base64 encoding, an XOR routine keyed with 0xAD, the browser TextDecoder API, and a final eval() call. The HTML file effectively becomes a self contained phishing delivery container.
The reconstructed page closely imitates the legitimate Microsoft 365 authentication workflow, complete with a fake CAPTCHA gate, and guides the victim through credential submission. Once credentials are entered, the kit moves beyond simple password theft and begins targeting the MFA process itself.
MFA Is No Longer the Final Barrier
Traditional phishing campaigns historically focused on stealing usernames and passwords. Mirage2FA directly targets the second authentication factor. Researchers observed phishing logic capable of soliciting several MFA mechanisms, and the second stage page was built to request:
- Authenticator application verification codes
- Microsoft number matching approval challenges
- SMS delivered one time passwords (identified in the codebase, though not interactively confirmed during testing)
- Session authentication material tied to the Microsoft 365 sign in
The approach resembles a real time adversary in the middle credential interception process, allowing attackers to undercut what many organizations still consider one of their strongest identity protections. It reflects the broader shift from credential phishing toward identity session hijacking.
Why Traditional Security Controls Often Miss This Attack
What makes Mirage2FA particularly effective is the decision to shift malicious logic into the file itself. Most enterprise phishing defenses still lean heavily on URL reputation analysis, DNS filtering, secure web gateways, browser isolation, signature based attachment scanning, and endpoint behavioral monitoring that only engages after execution.
Mirage2FA intentionally delays network interaction. The malicious HTML file executes locally, rebuilds JavaScript dynamically, and assembles phishing logic inside the browser session before meaningful network based detection can evaluate intent. From a security architecture perspective, the phishing page effectively materializes after the file has already been opened. By the time network defenses observe anything suspicious, credential harvesting may already be underway. The use of short lived, recently registered infrastructure such as cheacker[.]store, registered only days before the campaign, makes detection even harder.
Why FileDNA CADR Changes the Defensive Position
This type of campaign demonstrates precisely why file level security inspection must happen before execution rather than after behavioral detection begins. The Mirage2FA kit depends entirely on one critical requirement. The victim must successfully open the malicious HTML container.
This is exactly where FileDNA™ Content Analysis, Disarm and Reconstruction (CADR) becomes effective. Unlike reactive controls that wait for phishing behavior to begin, FileDNA analyzes the file itself before the user ever interacts with it. During deep file inspection, FileDNA can identify embedded JavaScript execution logic hidden inside HTML structures, heavily obfuscated scripting patterns designed to decode at runtime, suspicious encoded payloads built on Base64 or multi layer string deobfuscation routines, unauthorized redirect logic, embedded external resource loaders, and active content designed to reconstruct phishing interfaces inside browser execution environments.
Instead of trying to detect phishing later in the attack chain, the CADR engine performs upstream prevention at the file delivery stage. It can neutralize active content embedded inside the file, strip executable scripting components, reconstruct the document into a safe format, and let the user reach benign content without exposure to malicious execution logic. The phishing attack effectively dies before browser execution ever begins.
The Industry Is Moving Toward Identity Attacks, but Delivery Still Starts With Files
Modern phishing campaigns increasingly focus on bypassing MFA rather than stealing passwords alone. Threat actors now understand that compromising identity sessions offers far greater value than credential theft on its own. Yet despite the growing sophistication of these frameworks, the initial delivery mechanism remains familiar. A file arrives. A user opens it. Code executes. Credentials are stolen.
That pattern repeats across HTML phishing loaders, weaponized PDFs, malicious Office documents, browser based JavaScript droppers, and archive delivered malware. The attack surface is still the file.
Final Observation
Mirage2FA reinforces an important defensive lesson. Organizations continue investing heavily in identity security, MFA systems, secure browsers, and advanced phishing detection platforms. But attackers keep moving malicious logic upstream, embedding the attack directly inside files that execute locally before traditional defenses engage.
This is where technologies like FileDNA™ CADR become increasingly critical. Rather than detecting phishing after execution begins, organizations can eliminate malicious content at the exact moment it enters the environment. Because in modern phishing campaigns, the first compromise often happens long before the user ever reaches the login page.