Researchers tie the LinX Coders phishing-as-a-service toolkit to 9,332 compromise events across 94 countries, with 63.7% of victims in the United States and stolen session cookies accounting for more than half of all outcomes.
A phishing-as-a-service (PhaaS) toolkit tracked as Mirage2FA has been linked to the potential compromise of 4,532 Microsoft 365 accounts in a campaign that targeted 3,518 organizations, according to new research published by threat intelligence analysts ShiFu and raptur3 at ANY.RUN.
The kit does not drop malware. Instead, it uses browser-executed HTML, XHTML, and SVG attachments to funnel victims to a fake Microsoft login page backed by an adversary-in-the-middle (AiTM) reverse proxy.
The proxy relays the username, password, and one-time 2FA code to Microsoft in real time and captures the authenticated session cookie that comes back, letting the attacker enter the account without ever typing a password or completing MFA again.
Nearly Half of Targeted Accounts Were Potentially Compromised
ANY.RUN’s telemetry shows the campaign reached 9,426 unique email addresses, and roughly 48% of them were potentially compromised.
Victim activity was logged in 94 countries, but the United States dominates with 2,885 victims, or 63.7% of the total, far ahead of India (5.1%), Singapore (4.1%), the United Kingdom (1.7%), and Canada (1.7%).
Technology companies were hit hardest at 19.2% of victims, followed by manufacturing (11.1%), education (9.9%), consulting (8.3%), telecommunications (6.6%), healthcare (5.4%), and finance (3.1%).
MSSPs also feature among the most affected sectors, a detail that matters because a single compromised provider account can expose the customers it manages.
The operator has been active since at least September 2024, but the tempo changed in 2026.
Sandbox detections began a steady climb in March, and July alone produced 445 Mirage2FA sessions in ANY.RUN’s Interactive Sandbox with the month only partially recorded, out of 1,249 sessions analyzed in total.
.webp)
Session Cookies Make Up More Than Half of All Thefts
Of the 9,332 compromise events recorded, 4,561 (51%) involved the theft of an authenticated session cookie, affecting 2,541 unique victims.
Another 3,044 events (34%) captured a password together with a 2FA code, 1,339 (15%) were single sign-on logins, and 388 fell into other categories.
The dominance of cookie theft changes the incident response math. Because the attacker holds a valid session rather than just a password, a password reset does not evict them.
Mirage2FA stores the stolen cookies as Base64-encoded .txt dumps on its operator panel, ready to be replayed against Microsoft 365, SSO-connected applications, and internal workflows.
One in three successful login events (33.3%) came from mobile devices, where users have fewer visual cues to spot a phishing page.
The business impact reaches well beyond the mailbox. A hijacked identity gives the attacker trusted access to connected cloud services, enables fraud against employees, customers, and suppliers, and widens the blast radius to every SSO-connected application, while containment costs rise because a credential reset alone no longer closes the door.
The Full Attack Chain: From Attachment to Account Takeover
The attack begins with a phishing email, frequently themed around HR notices or 401(k) benefit updates and sent in volume through Amazon SES (MITRE ATT&CK T1566.001/.002).
The message carries a .htm, .xhtml, or .svg attachment, or a QR code that pushes the victim to open the phishing link on a phone.
When the victim opens the file, the browser runs an embedded stager (T1204.002). The stager carries a per-recipient token, the victim’s email address Base64-encoded into a placeholder named LINXB64EMAIL, and fetches the harvesting logic from a remote loader using a URL of the form /xls/
In ANY.RUN’s sandbox, the attachment first shows a “Verify you’re human” slider before loading a Microsoft-branded password prompt with the victim’s email already filled in.
Behind the page, the browser pulls the loader from user.cheacker[.]store, opens a WebSocket to the command-and-control server, posts to an xwps.php handler on a second domain, and queries api.ipify.org to fingerprint the victim’s IP address.
The credentials and 2FA code are relayed to the legitimate Microsoft service over that WebSocket channel (T1557, T1111).
Once Microsoft accepts them, the proxy receives a valid authenticated session, which is exfiltrated along with the credentials (T1539) and reused to read mail and impersonate the user (T1071.001).
Across the 1,249 sandbox sessions, the dominant behaviors were phishing, obfuscated JavaScript execution, WebSocket activity tied to the AiTM channel, IP and browser fingerprinting, QR-code delivery, and Amazon SES activity.
Six Stager Variants, Zero Binary Malware
ANY.RUN catalogued 629 .htm samples (453 of them obfuscated), 198 XHTML samples (31 obfuscated), and 187 SVG samples (12 obfuscated).
The plain .htm variant is a two-line stub that sets a uid token and pulls /api/xls/a1p2i.js from the kit’s domain.
The non-obfuscated XHTML version builds a full-screen iframe, writes a document into it, and injects the same a1p2i.js loader, reading the token from a ?ref= parameter.
Its obfuscated counterpart hides the logic behind a hex-to-string decoder, rsy(), and reads the token from ?sdv= or the URL fragment.
The obfuscated .htm variant is self-contained: it Base64-decodes a blob, XORs every byte with 0xAD (173), and passes the result to eval().
SVG files abuse the
A dozen samples wrap that redirect in an obfuscator.io-style string-array decoder to hide the destination.
Infrastructure Points to a Single Operator: LinX Coders
The loader and C2 traffic resolve to 185.174.100.224 on AS-Colocrossing, which serves domains including user.cheacker[.]store, hvr.volatilesour[.]store, ver.bandhiem[.]com, and pynutech[.]store.
Loader requests follow a fixed structure, https://
.webp)
The researchers attribute the kit to a group branding itself LinX Coders. The evidence includes the LINXCODERSEMAIL substitution placeholder, Telegram bots named linxlogsss…bot and linxxlogss…bot, a channel called LinXcoded that advertises a “LinX Sender,” a “2FA Cookies Attachment/Link,” and a “LinXMail Token Link App,” and operator test messages sent from IP addresses in the same 185.174.100.0/24 subnet as the production C2.
Build markers evolved from LINXCODERSEMAIL to LINXEMAIL to LINXB64EMAIL, and the most recent operator test, a login using the password linxz, was logged on July 3, 2026.
The analysts caution that the IP and geolocation data comes from the panel’s own logging and could reflect VPN use or spoofing; the stronger signal is the reuse of the same addresses across multiple bots and their subnet overlap with infrastructure ANY.RUN observed independently.
A single bot ID also ties the 2024–2025 test messages to the 2026 lure activity. Over that period the kit moved from plain loaders to XOR, hex, and obfuscator.io wrappers, added new /xls/ routes and token variants, and rotated its domains.
What Defenders Should Do
ANY.RUN recommends blocking or quarantining .htm, .xhtml, and .svg attachments at the mail gateway, adding detections for HTML smuggling and obfuscated JavaScript, and scrutinizing QR-code lures and mail arriving via Amazon SES.
High-risk users, including administrators, executives, and finance teams, should move to phishing-resistant MFA such as FIDO2/WebAuthn keys or passkeys, backed by shorter session lifetimes, token binding, and Continuous Access Evaluation in Microsoft Entra ID.
For hunting, the report highlights patterns that outlive any single domain:
- Loader requests matching /[a-z]{3}/xls/[a-z0-9]+(?:c2v|cpt)?\.js, with /api/xls/a1p2i.js as the canonical endpoint
- DNS queries where a Base64-encoded email address appears as the subdomain label of cheacker[.]store
- An outbound WebSocket connection to an unknown host immediately after a JavaScript loader fetch
- HTML attachments containing atob(…).map(x => x.charCodeAt(0) ^ 173) followed by eval(…)
- SVG documents with an inline
- LINX* placeholder strings and in-page variables such as uid, self.u, and RSTRING2
When session theft is confirmed, ANY.RUN advises treating it as an identity incident rather than a credential reset: revoke all active sessions and tokens, review Microsoft 365 mail-forwarding rules and OAuth grants, and audit every action taken through the compromised identity.
Indicators of Compromise (Selection)
| Type | Indicator |
|---|---|
| C2 / loader IP | 185.174.100.224 (AS-Colocrossing) |
| Loader domains | user.cheacker[.]store, hvr.volatilesour[.]store, ver.bandhiem[.]com, pynutech[.]store |
| Phishing domains (sample) | pectech[.]store, bns.baseasix[.]com, adp.pslcertlive[.]site, office.pcvgtech[.]store, hpn.bandhiem[.]com, vrf.iar0nline[.]com, ans.rsxbenefits[.]com |
| Loader path | /<3-letter-code>/xls/ |
| Build markers | LINXB64EMAIL, LINXEMAIL, LINXCODERSEMAIL, LINXCODERSRANDSTRING, #LINXMASKEMAIL, #LINXRANDSTRING, linxz |
| Obfuscation key | XOR 0xAD (173) + Base64 + eval |
| Activity window | September 2024 – July 2026 (observed) |
The full report includes the complete list of more than 60 phishing domains and 21 operator testing IP addresses.