CriticalMalicious packageCVE-2026-69836updated 1 Nov 2026, 15:17 UTC

Mirage2FA AiTM proxy steals Microsoft 365 session cookies despite MFA

Unverified

Severity	CriticalMalicious package
Being exploited?	UnclearNo reports either way yet
What to do	Remove itSee the steps below
How sure is this?	UnverifiedOnly one publisher so far, details may change

Timeline

1 Nov 2026, 10:15 UTC
Publicly disclosed
1 Nov 2026, 10:15 UTC
Reported by r/netsec · r/netsec
1 Nov 2026, 15:17 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Community discussion sites, treat with care

Mirage2FA stole 4,561 M365 session cookies despite MFA via AiTM proxy (CVE-2026-69836 CVSS 10.0) : detection rules and WHfB/Cloud Kerberos Tr/netsec · 1 Nov 2026, 10:15 UTC

Technical details

ID: CVE-2026-69836
Disclosed: 1 Nov 2026, 10:15 UTC
On Zero Radar: 1 Nov 2026, 15:17 UTC (5 h after disclosure)
Last change: 1 Nov 2026, 15:17 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Mirage2FA AiTM proxy steals Microsoft 365 session cookies despite MFA · Zero Radar