BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFA
CloudSEK uncovered BigBear 2.0, a PhaaS operation that captured 4,148 Microsoft 365 session cookies, hijacking authenticated sessions after MFA via AiTM proxy.
CloudSEK infiltrated the BigBear 2.0 phishing-as-a-service panel in June, finding 5,137 credential records tied to 461 organizations in over 40 countries, including 4,148 captured session cookies and 474 completed post-MFA logins. The operation, built on Evilginx2, uses an attacker-controlled reverse proxy to steal authenticated session cookies and residential proxies to defeat location-based Conditional Access checks, while custom code disables FIDO2/WebAuthn on phishing pages. At least five affiliates operated 42 VPS nodes, with IT services and managed service providers the most targeted sector.
- Built on Evilginx2 AiTM framework with residential proxies matched to victim country
- Custom code disables FIDO2/WebAuthn, steering users to phishable authentication
- 4,148 session cookies and 1,032 plaintext passwords captured; 474 post-MFA logins
- IT services and MSPs represent 151 of 461 targeted organizations
- Experts recommend phishing-resistant authentication and treating session tokens as high-value
- Products
- Microsoft 365Evilginx2
- Threat actors
- BigBear 2.0
From the original article
4 min read at csoonline.com
A phishing-as-a-service operation targeting Microsoft 365 users has harvested thousands of session cookies that could be used to hijack authenticated sessions after victims complete multifactor authentication, CloudSEK said. The cybersecurity firm said in a report that it uncovered the operation, known as BigBear 2. 0, in June after gaining access to its administrative panel.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.