Cybersecurity Projects in United StatesCybersecurity Projects in United StatesHave you wondered how hacekrs bypass MFA? Nowadays it is getting easier. There is a phishing kit called Mirage2FA that has been working against Microsoft 365 since late 2024.
Here is how it goes. The user lands on a fake login page. They type their password. They approve the MFA prompt on their phone. Everything they enter is passed straight through to Microsoft in real time, so the sign-in genuinely succeeds and looks completely normal to them. Microsoft issues the session tokens, and the kit keeps a copy.
With those cookies someone can read the mailbox, open SharePoint and OneDrive, and reach anything sitting behind SSO. They never see a second prompt, because the authentication already happened.
ANY.RUN (http://ANY.RUN) put numbers on it. 9,426 accounts targeted across 3,518 domains, roughly 4,532 showing signs of compromise, most of them in the US. A third of the successful logins happened on phones, where you can barely see the URL you are looking at.
The advice going around is to switch on Continuous Access Evaluation. I would switch it on too. Just read the documentation first, because it does something slightly different to what people assume.
CAE sessions run tokens for up to 28 hours. The default is one hour. What you get in exchange is revocation when something happens, and Microsoft is specific about what counts: the account is disabled or deleted, the password is changed or reset, MFA gets turned on, an admin revokes refresh tokens, or ID Protection flags the user as high risk. Allow up to 15 minutes for that to propagate. IP location is the only one that applies straight away.
Three things worth knowing before you lean on it. It covers Exchange Online, SharePoint Online and Teams. Guest accounts are not supported, which is where a lot of contractor access lives. And it only reads IP-based named locations, so a country-based policy buys you nothing here.
If I were fixing this in a tenant tomorrow, in this order:
Phishing-resistant sign-in first. A FIDO2 key checks the domain it is talking to, so it will not hand anything over to a proxy wearing Microsoft's face.
CAE on, so revocation actually reaches the services.
Then a runbook where you revoke sessions before you reset the password. Reset first and you have changed the lock while someone is still inside holding a key that works.
If session cookies walked out of your tenant this morning, what would notice, and how long would it take?
Source: ANY.RUN (http://ANY.RUN) threat research, 19 August 2026. CAE behaviour from Microsoft Learn.
New work: I rebuilt my studio site as a real-time 3D experience, then I attacked it.
The visual layer is hand-written WebGL and GLSL. GPU particle cores that react to your cursor, morphing transitions between pages, adaptive performance that tunes itself to the device. All custom code, no template, no page builder.
But looking expensive is only half the job. I also build and secure the systems behind sites like this: multi-tenant SaaS, Stripe billing, PostgreSQL row-level security. So I wrote an automated red-team loop in Python and ran it against my own live site: attack, triage, patch, verify. It flagged a couple of hardening gaps, I fixed them, and re-ran until it came back clean.
If you want a site that looks like a high-budget trailer and holds up when someone probes it, that is what I build.
Live: xkaii.studio
(http://xkaii.studio)The security work: xkaii.studio/security 
