BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFA
CloudSEK uncovered BigBear 2.0, a PhaaS operation that captured 4,148 Microsoft 365 session cookies, hijacking authenticated sessions after MFA via AiTM proxy.
74
Product
Evilginx2
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 8, 2026
- Last mentionedSep 8, 2026
Timeline
2 articles · newest firstBigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft
CloudSEK identified BigBear 2.0, an Evilginx2-based AiTM phishing operation stealing Microsoft 365 MFA session cookies, hitting 461 organizations across 40-plus countries.
74
Appears with
- Microsoft 365product · 2
- Microsoftvendor · 2
- CloudSEKvendor · 2
- BigBear 2.0product · 1
- BigBear 2.0threat actor · 1
- General Bossthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.