BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
CloudSEK found the BigBear 2.0 phishing-as-a-service platform bypassed MFA at 258 organizations and captured over 5,000 Microsoft 365 credentials.
CloudSEK researchers gained administrator access to the BigBear 2.0 phishing-as-a-service control panel and found it had exfiltrated 5,137 credential records, including 474 completed MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies across 3,331 victim IPs in 40+ countries. The Evilginx2-based AitM proxy intercepts credentials and authenticated session cookies, and custom JavaScript interferes with FIDO2/WebAuthn to force weaker authentication. The panel is leased to at least five affiliate operators via Telegram exfiltration bots, and geo-matched residential proxies cover 69 countries to evade detection.
- 258 distinct organizations had at least one completed MFA-bypass compromise; 461 appeared in targeting data
- Service managed 42 VPS nodes and remains leased to at least five affiliates with active operation
- Custom JavaScript disrupts FIDO2/WebAuthn, pushing victims toward weaker MFA methods
- Geo-matched residential proxies in 69 countries reduce Microsoft risk-flagging
- Affected users should reset passwords, revoke sessions, and enforce phishing-resistant authentication
- Products
- Microsoft 365BigBear 2.0
- Threat actors
- BigBear operators
- Organizations
- CloudSEK
From the original article
2 min read at bleepingcomputer.com
A phishing-as-a-service framework called BigBear 2. 0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.