BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
The BigBear 2.0 phishing-as-a-service framework bypassed MFA to steal 5,000+ Microsoft 365 credentials across 258 organizations, CloudSEK researchers found.
CloudSEK researchers gained administrator access to the BigBear 2.0 control panel, finding the phishing-as-a-service operation ran 42 VPS nodes all configured to target Microsoft 365. The framework has been used to bypass multi-factor authentication at 258 organizations and harvest more than 5,000 credentials, indicating an active credential-theft campaign against enterprise tenants.
- CloudSEK gained admin access to the PhaaS control panel
- Operation ran 42 VPS nodes, all targeting Microsoft 365
- MFA bypass yielded 5,000+ stolen credentials across 258 organizations
- Vendors
- Microsoft
- Products
- Microsoft 365
- Threat actors
- BigBear 2.0
- Organizations
- CloudSEK
From the original article
Bill Toulas reports: A phishing-as-a-service framework called BigBear 2. 0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials. Researchers at cybersecurity company CloudSEK gained administrator access to the control panel and found that the service managed 42 VPS nodes, all configured to target Microsoft 365 as...
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.