Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
Mirage2FA: The Phishing Service Turning a Stolen Microsoft 365 Cookie Into Full Account Takeover
Excerpt
A phishing-as-a-service kit sold by a crew calling itself LinX Coders steals the one thing a password reset can’t fix — the live session cookie — and ANY.RUN’s telemetry ties it to 9,332 compromise events reaching 94 countries. For most defenders, a phishing alert ends with a forced password change. Mirage2FA is built to make that response useless. The phishing-as-a-service kit documented by ANY.RUN threat intelligence analysts ShiFu and…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | hvr.volatilesour.store | High | Score 58/100 | First seen |
| Domain | ans.rsxbenefits.com | High | Score 63/100 | First seen |
| Domain | vrf.iar0nline.com | High | Score 63/100 | First seen |
| Domain | ver.bandhiem.com | High | Score 58/100 | First seen |
| Domain | user.cheacker.store | High | Score 58/100 | First seen |
| Domain | hpn.bandhiem.com | High | Score 63/100 | First seen |
| Domain | bns.baseasix.com | High | Score 63/100 | First seen |
| Domain | pynutech.store | High | Score 63/100 | First seen |
| Domain | cheacker.store | High | Score 58/100 | First seen |
| Domain | pectech.store | High | Score 62/100 | First seen |
| Domain | office.pcvgtech.store | High | Score 63/100 | First seen |
| Domain | adp.pslcertlive.site | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…