A technical guide published on 1 November by doit4everyone.github.io says the Mirage2FA phishing platform, run by a group called LinX Coders, targeted 9,426 Microsoft 365 accounts on 20 August. It reports 4,561 confirmed session thefts. The guide says attackers placed a WebSocket proxy between user and Microsoft, let the MFA check pass, then took the session cookie. It adds that Microsoft disclosed CVE-2026-69836 on 21 August, a deserialization flaw in Entra ID that allows remote code execution, rated 10.0 and exploited before the fix.
Every figure, the CVE details and the LinX Coders attribution rest on this one guide, written for IT consultants and small firms. It cites no primary source, and Microsoft is not quoted. The guide does not link the two incidents or say how many tenants the flaw touched. It says Microsoft fixed the flaw on its own servers.
The guide argues that MFA protects the login, not the session it creates. A session cookie counts as proof of identity, whatever method produced it. It says tokens under continuous access evaluation last 20 to 28 hours, not 60 to 90 minutes, so fast detection decides the outcome. It estimates about 53 minutes of valid cookie remain after detection without that feature, and under 10 with it. Ask IT: how fast do we spot a stolen session, and can we revoke it within minutes?