HTML attachment phishing from authenticated M365 sender (LinXcoded/Mirage2FA)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•2

This rule detects inbound email messages containing HTML or related file types (htm, mhtml, shtml) that passed all standard authentication checks (SPF, DKIM, DMARC). This combination is often indicative of malicious phishing campaigns (such as those using LinXcoded or Mirage2FA techniques) sent from compromised, yet properly authenticated, Microsoft 365 or similar cloud-hosted email accounts, which bypass traditional sender reputation filters.