BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.
- Evilginx2 proxy steals session cookies, bypassing MFA without defeating it directly
- Custom JavaScript disables FIDO2/WebAuthn, forcing users toward phishable MFA methods
- Leased to at least five affiliates; stolen credentials delivered in real time via Telegram bots
- CloudSEC recommends phishing-resistant FIDO2 authentication and token revocation
- Tags
- adversary-in-the-middlecloudsekevilginx2mfa-bypassmicrosoft-365phishingphishing-as-a-servicesession-cookie-theft
- Vendors
- Microsoft
- Threat actors
- BigBearGeneral Boss
- Organizations
- CloudSEK
- Countries
- India
From the original article
2 min read at theregister.comResearchers got inside the crooks' admin panel and found 5,137 stolen records tied to 461 organizations
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.