Tracking BigBear 2.0 Evilginx2 Phishing Campaign

BigBear 2.0 is a phishing-as-a-service framework based on Evilginx2 that targets Microsoft 365 users globally. It employs adversary-in-the-middle attacks using geo-matched residential proxies to circumvent multi-factor authentication mechanisms, including advanced FIDO2/WebAuthn MFA. The campaign has successfully exfiltrated thousands of credential records and session cookies, affecting a large number of victims worldwide. The service is operated by an individual or group named 'General Boss' and is leased to multiple affiliates, enabling widespread abuse. Automated cookie replay and real-time exfiltration through Telegram enhance the operational efficiency of the campaign.

The campaign compromises Microsoft 365 credentials and session cookies, allowing attackers to bypass multi-factor authentication protections, including FIDO2/WebAuthn. This enables unauthorized access to victim accounts, potentially leading to data theft, account takeover, and further exploitation. The scale of the campaign, with thousands of credentials stolen and over 3,300 unique victim IPs across more than 40 countries, indicates significant global impact.

No vendor patch or official fix applies as this is a phishing campaign rather than a software vulnerability. Defenders should focus on user education about phishing risks, deploying advanced phishing detection tools, monitoring for suspicious login activity, and enforcing conditional access policies that consider device and location risk. Organizations should also consider additional layers of security such as hardware security keys with phishing-resistant MFA and continuous session monitoring. Since the campaign uses residential proxies and real-time exfiltration, network anomaly detection and threat intelligence sharing may help identify and block related activity.