Tracking BigBear 2.0 Evilginx2 Phishing Campaign

In June 2026, researchers identified BigBear 2.0, a rebranded Evilginx2-based phishing-as-a-service (PhaaS) framework targeting Microsoft 365 credentials worldwide. The operation used 42 VPS nodes primarily on Vultr infrastructure and employed the 'offy' phishlet configuration. It utilized adversary-in-the-middle attacks combined with geo-matched residential proxy pools spanning 69 countries to evade detection and bypass MFA protections, including FIDO2/WebAuthn. The campaign exfiltrated 5,137 credential records, including 474 fully bypassed MFA authentications, 1,032 plaintext passwords, and 4,148 session cookies, impacting 3,331 unique victim IPs in over 40 countries. The service was multi-user and leased to at least five affiliate operators. Custom JavaScript injections disabled advanced MFA methods, and residential proxies helped bypass anti-bot defenses, enabling persistent unauthorized access to compromised Microsoft 365 environments.

The campaign compromised Microsoft 365 credentials globally, including bypassing MFA protections, resulting in unauthorized access to user accounts. The exfiltration of plaintext passwords and session cookies enables persistent access and potential further exploitation of compromised environments. The use of residential proxies and advanced evasion techniques increases the difficulty of detection and mitigation.

No vendor advisory or patch information is provided. Since this is a phishing-as-a-service campaign targeting Microsoft 365 credentials, mitigation should focus on user education to recognize phishing attempts, enforcing strong MFA methods resistant to interception (e.g., hardware tokens with phishing-resistant protocols), and monitoring for suspicious login activity. Organizations should review and enhance their detection capabilities for adversary-in-the-middle phishing attacks and consider blocking known malicious infrastructure where possible. Patch status is not yet confirmed — check vendor advisories for current remediation guidance.