Most phishing emails still rely on a link. A recipient clicks it, lands on a hosted page somewhere, and that page’s domain is at least something a security team can flag or block. New research from threat intelligence firm ANY.RUN, published August 25 and covered widely including by The Hacker News, describes a phishing-as-a-service platform called Mirage2FA that skips that step. It delivers the phishing page itself as an attachment.
An Attachment That Builds Its Own Phishing Page
Mirage2FA’s messages carry HTML, XHTML, or SVG files as attachments rather than links to a hosted page. When a recipient opens one, the attachment does not redirect anywhere; it runs locally in the browser, using an obfuscated JavaScript loader to assemble a convincing Microsoft 365 login page directly on the victim’s machine. There is no external URL for a scanner to check at the moment of delivery, because at that moment nothing malicious has left the attachment yet. The page only starts talking to attacker infrastructure once the victim begins typing into it, which is precisely the moment a link-based defense would already have had its one chance to intervene and missed it.
Real Credentials, a Real Code, a Real Session Cookie
Once a victim enters a username and password into that locally built page, Mirage2FA’s real theft begins. The kit runs an adversary-in-the-middle reverse proxy that relays those credentials to Microsoft’s actual login servers in real time, then passes along the one-time verification code the victim types in response to a genuine MFA prompt. Because the login is genuinely happening, Microsoft issues a genuine authenticated session cookie back, and the proxy captures that cookie before it reaches the victim. Researchers found the platform storing stolen cookies as base64-encoded text dumps on its operator panel, ready to be replayed against Microsoft 365, any connected single sign-on application, and whatever internal tools trust that session. The attacker never needs the password again and never needs to pass MFA again, because the session in front of them already has.
Two Years, 94 Countries, Nearly Half Compromised
ANY.RUN traced Mirage2FA’s infrastructure back to at least July 2024, running across more than 31 domains and 14 IP addresses for over two years before this research surfaced it at this scale. The current wave reached 9,426 email addresses across 3,518 organizations in 94 countries, with 63.7% of targets in the United States and technology, manufacturing, and education among the most targeted industries. Of those 9,426 targeted addresses, 4,532 were assessed as potentially compromised, a success rate above 48%. The lures were ordinary business documents: secure document notifications, remittance confirmations, automated billing statements, and payment requests, the kind of subject lines that generate a click without a second thought.
Why DMARC Never Enters This Picture
DMARC verifies one thing: whether the domain named in a message’s From header authorized the infrastructure that sent it. Mirage2FA’s operators do not need to spoof anyone’s domain to make this work, because the attachment itself carries the payload rather than a link pointing at a lookalike sender. A message built this way can go out from a domain the attacker controls outright, with its own valid SPF record, its own DKIM signature, and its own DMARC policy set to pass, and the check will do exactly what it is supposed to do: confirm that the sender had the authority to send from that domain. It was never designed to open an HTML attachment, evaluate the JavaScript inside it, or watch a reverse proxy relay a real login and a real MFA code to Microsoft’s actual servers a few seconds later. Every part of that chain happens after the one question DMARC answers has already been settled.
What This Means for Your Program
Extend attachment inspection to HTML, XHTML, and SVG files, not just executables and macros. A message that authenticates cleanly and carries what looks like a document attachment can still be the entire delivery mechanism for a phishing page, and filtering decisions built around suspicious links alone will not catch it.
Do not treat a passed MFA prompt as proof a login was safe. An adversary-in-the-middle proxy relays a real code to a real login server in real time, so the victim genuinely completes MFA while the attacker captures the session behind it; the defense that matters here is phishing-resistant authentication like passkeys, not an additional one-time code.
Watch for infrastructure that has been running for years, not days. Mirage2FA operated for over two years before this scale of research caught up to it, which means threat feeds built only on newly registered domains will miss infrastructure that has had time to age and build reputation.
Monitor session and token activity for impossible travel and reuse, not just failed logins. A stolen cookie lets an attacker skip the login screen entirely, so the signal to catch is a valid session appearing somewhere it should not be, not a login attempt that never happened.
The Takeaway
Mirage2FA is not interesting because it defeats MFA; adversary-in-the-middle kits have been doing that for a while. It is interesting because it removes the one part of a phishing email that most defenses are still built to inspect: the link. When the payload is an attachment that builds the page itself, and the domain sending it never needed to lie about who it was, authentication protocols answer their one question correctly and the attack proceeds anyway. That gap is not a flaw in DMARC. It is the edge of what DMARC was ever asked to do.
DMARC confirms a domain had the authority to send. It cannot inspect what an HTML attachment builds once it is opened, and it cannot see a reverse proxy relaying a real MFA code to Microsoft behind the scenes. Excello Mail turns your DMARC aggregate reports into a clear, continuous record of every domain and service sending as you, so the layer authentication actually covers stays watched while your team builds the defenses for everything that happens after the click. Sign up for free to Excello Mail and get that foundation in place.