BigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials
CloudSEK researchers found the BigBear 2.0 PhaaS kit, built on Evilginx2, has stolen over 5,100 Microsoft 365 credentials across 461 organizations in 40+ countries.
CloudSEK gained admin access to the BigBear 2.0 phishing-as-a-service panel, an Evilginx2-based adversary-in-the-middle platform operated by someone using the alias 'General Boss'. The team observed 3,331 unique victim IPs across more than 40 countries, 42 VPS nodes mostly on Vultr, and 5,137 credential records across 461 organizations, including 4,148 session cookies, 1,032 plaintext passwords, and 474 completed MFA-bypassed authentications. IT and managed service providers were the most targeted sector, raising supply-chain risk since their compromise can expose client infrastructure and privileged Azure AD access.
- BigBear 2.0 is Evilginx2-based PhaaS using the 'offy' phishlet targeting Microsoft 365.
- 5,137 credential records stolen across 461 organizations, including 4,148 session cookies.
- Geo-matched residential proxies, Telegram exfiltration, and automated cookie replay bypass MFA.
- IT/MSPs most targeted, creating downstream supply-chain attack risk.
- CloudSEK advises token revocation, password resets, and FIDO2/WebAuthn adoption.
- Products
- Microsoft 365Azure AD
- Threat actors
- General Boss
- Malware
- BigBear 2.0Evilginx2
From the original article
2 min read at infosecurity-magazine.com
CloudSEK has uncovered BigBear 2. 0, a new phishing-as-a-service operation targeting Microsoft 365
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.