BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
60
Threat actor
General Boss
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 8, 2026
- Last mentionedSep 8, 2026
Timeline
3 articles · newest firstBigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials
CloudSEK researchers found the BigBear 2.0 PhaaS kit, built on Evilginx2, has stolen over 5,100 Microsoft 365 credentials across 461 organizations in 40+ countries.
70
BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft
CloudSEK identified BigBear 2.0, an Evilginx2-based AiTM phishing operation stealing Microsoft 365 MFA session cookies, hitting 461 organizations across 40-plus countries.
74
Appears with
- Microsoft 365product · 3
- Microsoftvendor · 3
- CloudSEKvendor · 2
- Azure ADproduct · 1
- SharePointproduct · 1
- Vultrvendor · 1
- Evilginx2product · 1
- OneDriveproduct · 1
- BigBear 2.0product · 1
- CloudSEKorganization · 1
- Entra IDproduct · 1
- Evilginx2malware · 1
- IT service providersvictim · 1
- BigBearthreat actor · 1
- BigBear 2.0malware · 1
- Managed service providersvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.