BigBear 2.0 is a rebranded Evilginx2-based phishing-as-a-service framework discovered in June 2026. It targets Microsoft 365 credentials globally by deploying 42 VPS nodes mainly on Vultr infrastructure and using the 'offy' phishlet configuration. The platform employs adversary-in-the-middle attacks combined with geo-matched residential proxy pools across 69 countries to evade detection and bypass multi-factor authentication (MFA), including disabling FIDO2/WebAuthn via custom JavaScript injections. The campaign exfiltrated 5,137 credential records, including 474 full MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies, affecting over 3,300 unique victim IPs in more than 40 countries. The service is multi-user and leased to at least five affiliate operators, with real-time data exfiltration via Telegram and automated cookie replay to maintain persistent access to compromised Microsoft 365 environments.

The campaign compromises Microsoft 365 accounts by bypassing MFA protections, including advanced FIDO2/WebAuthn methods, enabling attackers to gain persistent unauthorized access. The exfiltration of plaintext passwords and session cookies allows attackers to impersonate users and maintain long-term access to victim environments. This undermines the security of affected organizations and individuals globally, potentially leading to data breaches, unauthorized access to sensitive information, and further exploitation within compromised networks.

No direct patch or fix applies as this is a phishing campaign leveraging social engineering and technical bypasses of MFA. Organizations should enforce strong phishing awareness training, monitor for suspicious login activity, and consider additional protective measures such as conditional access policies and anomaly detection. Since this is a phishing-as-a-service operation, vigilance against phishing attempts and rapid incident response to compromised accounts are critical. The vendor advisory or authoritative source does not indicate any automated remediation or patch availability.