Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials

Fortra researchers analyzed a Mirage2FA phishing campaign that uses short-lived HTML smuggling and obfuscated JavaScript loaders to deliver staged fake Microsoft 365 login pages (including MFA prompts) to harvest credentials and potentially bypass MFA; observed indicators include cheacker.store and user.cheacker.store along with associated IPs and JavaScript resources, and recommended remediation steps include password resets, session/token revocation, MFA review, mailbox rule inspection, and OAuth grant checks.