BigBear 2.0 is a phishing-as-a-service (PhaaS) framework that uses an Evilginx2-based adversary-in-the-middle proxy to intercept Microsoft 365 credentials, including passwords, multi-factor authentication tokens, and session cookies, enabling attackers to bypass MFA and hijack user sessions. The service manages multiple VPS nodes and uses geo-matched residential proxies to avoid triggering Microsoft's security alerts. It also employs custom JavaScript to disable FIDO2/WebAuthn browser functionality, forcing victims to use weaker authentication methods. CloudSEK researchers accessed the control panel and found that the campaign compromised 258 distinct organizations, exfiltrating over 5,000 credential records and affecting over 3,300 unique victim IPs across 40+ countries. The phishing infrastructure has been offline for nearly three weeks, but the administration panel remains accessible. The service is leased to multiple affiliate operators who receive stolen credentials in real time via Telegram bots. CloudSEK has notified law enforcement and affected organizations.

The campaign successfully bypassed MFA protections at 258 organizations, resulting in the theft of over 5,000 Microsoft 365 credentials, including plaintext passwords, MFA tokens, and session cookies. This allows attackers to hijack authenticated sessions and gain unauthorized access to Microsoft 365 services such as Exchange Online, Teams, SharePoint, OneDrive, and Entra ID. Compromise of these accounts can lead to exposure of sensitive emails and files, and potentially broader access through single sign-on integrations. The use of geo-matched proxies and disabling of phishing-resistant authentication methods increases the likelihood of successful account takeover without triggering security alerts.

Organizations potentially affected by BigBear should immediately reset exposed passwords, revoke all active sessions, refresh authentication tokens, and enforce re-authentication for high-privileged accounts. It is recommended to enforce phishing-resistant authentication methods such as FIDO2/WebAuthn and implement Conditional Access policies requiring managed devices rather than relying on geo-location signals. CloudSEK has notified law enforcement and affected entities. The phishing infrastructure has been offline for nearly three weeks, but the administration panel remains online, so vigilance is advised.