Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
87 IOCs
Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US
Excerpt
Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle (AiTM) attacks. ANY.RUN research shows that 63.7% of identified victims are in the US , with Technologies , Manufacturing , and Education among the most targeted industries. The operation has generated thousands of compromise events between 2024 and 2026, including stolen session cookies, passwords, and SSO access. Once an…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →87 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | hynutech.store | High | Score 58/100 | First seen |
| IP | 139.28.36.38 | High | Score 58/100 | First seen |
| IP | 98.98.79.35 | High | Score 58/100 | First seen |
| Domain | pureaveritax.store | High | Score 58/100 | First seen |
| Domain | pxvbtech.store | High | Score 58/100 | First seen |
| IP | 181.214.165.173 | High | Score 58/100 | First seen |
| IP | 84.239.27.17 | High | Score 58/100 | First seen |
| Domain | pavetech.store | High | Score 58/100 | First seen |
| Domain | ari.vslbertlive.info | High | Score 58/100 | First seen |
| Domain | oectech.store | High | Score 58/100 | First seen |
| Domain | jverster.store | High | Score 58/100 | First seen |
| Domain | vns.pigotnet.com | High | Score 58/100 | First seen |
| Domain | vns.tvgsv.com | High | Score 58/100 | First seen |
| Domain | ans.rsxbenefits.com | High | Score 63/100 | First seen |
| IP | 185.174.100.20 | High | Score 58/100 | First seen |
| IP | 84.239.25.139 | High | Score 58/100 | First seen |
| Domain | ver.verpox.shop | High | Score 58/100 | First seen |
| IP | 84.239.25.144 | High | Score 58/100 | First seen |
| Domain | bverster.store | High | Score 58/100 | First seen |
| Domain | cementslabconstruction.com | High | Score 58/100 | First seen |
| Domain | cureaveritax.store | High | Score 58/100 | First seen |
| Domain | zectech.store | High | Score 58/100 | First seen |
| Domain | vrf.iar0nline.com | High | Score 63/100 | First seen |
| Domain | rfm.m3-bulders.com | High | Score 58/100 | First seen |
| Domain | cer.septey.shop | High | Score 58/100 | First seen |
| IP | 146.70.195.104 | High | Score 58/100 | First seen |
| Domain | dezbelz.store | High | Score 58/100 | First seen |
| Domain | wectech.store | High | Score 58/100 | First seen |
| Domain | galatasaraydanhaberler.com | High | Score 58/100 | First seen |
| Domain | rmf.m3-bulders.com | High | Score 58/100 | First seen |
| IP | 84.239.25.135 | High | Score 58/100 | First seen |
| Domain | bezdelz.store | High | Score 58/100 | First seen |
| Domain | avsbtech.store | High | Score 58/100 | First seen |
| IP | 83.147.53.130 | High | Score 58/100 | First seen |
| Domain | sopbtech.store | High | Score 58/100 | First seen |
| Domain | dverster.store | High | Score 58/100 | First seen |
| Domain | pancincorp.com | High | Score 58/100 | First seen |
| Domain | hverster.store | High | Score 58/100 | First seen |
| Domain | vrf.gavernova.com | High | Score 58/100 | First seen |
| Domain | wes.cadsta.online | High | Score 58/100 | First seen |
| Domain | gacorslot7d.com | High | Score 58/100 | First seen |
| Domain | fureaveritax.store | High | Score 58/100 | First seen |
| Domain | cvs.pcvgtech.online | High | Score 58/100 | First seen |
| Domain | pvf.schwiessdoors.com | High | Score 58/100 | First seen |
| Domain | fverster.store | High | Score 58/100 | First seen |
| Domain | svr.schwiessdoors.com | High | Score 58/100 | First seen |
| IP | 199.233.237.30 | High | Score 58/100 | First seen |
| IP | 185.199.103.116 | High | Score 58/100 | First seen |
| Domain | hpn.bandhiem.com | High | Score 63/100 | First seen |
| Domain | office.avcbtech.store | High | Score 58/100 | First seen |
| Domain | bns.baseasix.com | High | Score 63/100 | First seen |
| IP | 98.93.13.101 | High | Score 58/100 | First seen |
| Domain | intrugementslayerdocuservice.com | High | Score 58/100 | First seen |
| IP | 98.144.204.109 | High | Score 58/100 | First seen |
| Domain | everster.store | High | Score 58/100 | First seen |
| Domain | jureaveritax.store | High | Score 58/100 | First seen |
| IP | 141.95.59.233 | High | Score 58/100 | First seen |
| Domain | pynutech.store | High | Score 63/100 | First seen |
| Domain | jscvbtech.store | High | Score 58/100 | First seen |
| IP | 209.205.192.6 | High | Score 58/100 | First seen |
| IP | 192.52.166.55 | High | Score 58/100 | First seen |
| Domain | svn.dpsindustrialsgroup.com | High | Score 58/100 | First seen |
| Domain | vrf.bereetro.it.com | High | Score 58/100 | First seen |
| IP | 185.174.100.76 | High | Score 58/100 | First seen |
| Domain | cer.verpox.shop | High | Score 58/100 | First seen |
| IP | 84.239.43.155 | High | Score 58/100 | First seen |
| IP | 185.91.122.32 | High | Score 58/100 | First seen |
| IP | 209.205.197.130 | High | Score 58/100 | First seen |
| Domain | pvs.schwiessdoors.com | High | Score 58/100 | First seen |
| Domain | ars.greebys.com | High | Score 58/100 | First seen |
| Domain | pectech.store | High | Score 62/100 | First seen |
| Domain | rmf.diversesgs.com | High | Score 58/100 | First seen |
| Domain | bsf.allmetreod.com | High | Score 58/100 | First seen |
| Domain | office.pcvgtech.store | High | Score 63/100 | First seen |
| Domain | vezbelz.store | High | Score 58/100 | First seen |
| Domain | vns1.pigotnet.com | High | Score 58/100 | First seen |
| Domain | pezbelz.store | High | Score 58/100 | First seen |
| Domain | iverster.store | High | Score 58/100 | First seen |
| IP | 185.174.100.224 | High | Score 58/100 | First seen |
| Domain | gztev.it.com | High | Score 58/100 | First seen |
| Domain | mettsoll.com | High | Score 58/100 | First seen |
| Domain | vrf.atskinsonel.com | High | Score 58/100 | First seen |
| Domain | gverster.store | High | Score 58/100 | First seen |
| Domain | asvbtech.store | High | Score 58/100 | First seen |
| Domain | adp.pslcertlive.site | High | Score 63/100 | First seen |
| Domain | gectech.store | High | Score 58/100 | First seen |
| Domain | implentedgucedirectory.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…