A phishing-as-a-service (PhaaS) framework known as BigBear 2.0 has been identified as a tool used to bypass multi-factor authentication (MFA) across 258 organizations, resulting in the theft of over 5,000 Microsoft 365 credentials. Cybersecurity researchers gained administrative access to the service's control panel, revealing an operation that managed 42 virtual private server (VPS) nodes, all configured to target Microsoft 365.
The campaign leverages an Evilginx2-based adversary-in-the-middle (AiTM) framework, specifically utilizing a configuration dubbed "offy." This setup establishes a man-in-the-middle proxy between a victim and Microsoft's legitimate authentication infrastructure. This allows the attackers to intercept credentials, including MFA responses, and authenticated session cookies, which are then replayed via an API to hijack the victim's authentication session.
The researchers reported that the BigBear panel exfiltrated 5,137 credential records. This total includes 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies, impacting 3,331 unique victim IP addresses across more than 40 countries. At the time of the report, the operation was still active. While the broader targeting dataset included 461 organizations, 258 distinct organizations experienced at least one successful MFA-bypass compromise.
The multi-user PhaaS panel is reportedly leased to at least five affiliate operators, who were identified through live Telegram exfiltration bots that delivered stolen credentials in real time.
To enhance its effectiveness, BigBear employs custom JavaScript designed to interfere with FIDO2/WebAuthn authentication, disabling browser functionality for these methods and thereby pushing targets towards less secure authentication options. The platform also utilizes geo-matched residential proxies for 69 countries. This tactic matches the victim's location with a residential IP address, aiming to prevent Microsoft's authentication servers from flagging the activity as suspicious.
Microsoft 365 encompasses a suite of cloud productivity and identity services, including Exchange Online, Teams, SharePoint, OneDrive, and Entra ID authentication. A compromise of an authenticated Microsoft 365 session could expose email and files, and potentially grant access to other applications linked through single sign-on.
Researchers stated they have informed law enforcement and several affected organizations, providing credentials in responsible-disclosure reports. Although the administration panel remained online at the time of reporting, the associated phishing infrastructure had been offline for approximately three weeks.
Organizations potentially affected by BigBear activity are advised to reset exposed passwords, revoke active sessions, refresh tokens, and enforce re-authentication for high-privileged accounts. Furthermore, it is recommended to implement phishing-resistant FIDO2/WebAuthn and utilize Conditional Access policies that mandate managed devices, rather than relying solely on geo-location signals for security.
