BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft
AI summary · glm-5.3-flashSummaries by Vani AI
CloudSEK identified BigBear 2.0, an Evilginx2-based AiTM phishing operation stealing Microsoft 365 MFA session cookies, hitting 461 organizations across 40-plus countries.
The campaign proxies Microsoft sign-in pages to capture credentials and authenticated session cookies, enabling session replay into email, Teams, SharePoint, OneDrive, and connected SSO applications. CloudSEK's June 2026 discovery found 5,137 stolen records, 1,032 passwords, and 4,148 session cookies tied to 3,331 victim IPs, linked to operator 'General Boss' across 42 VPS nodes. The operation targeted IT services and managed service providers, used country-matched residential proxies, and involved at least five affiliates.
Key facts
- 474 complete authenticated sessions stolen alongside 1,032 passwords
- Victims pushed away from security-key authentication toward phishable MFA
- Defenders urged to revoke sessions and tokens, not just reset passwords
- FIDO2/WebAuthn passkeys recommended as the phishing-resistant control
- Threat actors
- General Boss
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | annastudios-paros.com | shing domain Domain ccpipharma[.]com Phishing domain Domain annastudios-paros[.]com Phishing domain Domain dnsforward[.]com Phishing domain D |
| domain | arrmmy.com | omain daengrentacar[.]com Historical phishing domain Domain arrmmy[.]com Historical phishing domain Domain captelind[.]com Histori |
| domain | captelind.com | omain Domain arrmmy[.]com Historical phishing domain Domain captelind[.]com Historical phishing domain Domain planisteradmin[.]com Hi |
| domain | ccpipharma.com | node Domain konceptenterprises[.]com Phishing domain Domain ccpipharma[.]com Phishing domain Domain annastudios-paros[.]com Phishing d |
| domain | cifutura.com | ishing domain Domain dataclust[.]com Phishing domain Domain cifutura[.]com Phishing domain Domain hoaivt[.]com Phishing domain Domai |
| domain | daengrentacar.com | domain Domain soil-management[.]com Phishing domain Domain daengrentacar[.]com Historical phishing domain Domain arrmmy[.]com Historical |
| domain | dataclust.com | omain Domain hotelmidtownsurat[.]com Phishing domain Domain dataclust[.]com Phishing domain Domain cifutura[.]com Phishing domain Dom |
| domain | dnsforward.com | omain Domain annastudios-paros[.]com Phishing domain Domain dnsforward[.]com Phishing domain Domain hotelmidtownsurat[.]com Phishing d |
| domain | dronalms.com | Phishing domain Domain hoaivt[.]com Phishing domain Domain dronalms[.]com Phishing domain Domain virextec[.]com Phishing domain Dom |
| domain | haliotisbar.com | in hnospascualfadon[.]com Historical phishing domain Domain haliotisbar[.]com Historical phishing domain Domain knowncontractor[.]com H |
| domain | hnospascualfadon.com | main planisteradmin[.]com Historical phishing domain Domain hnospascualfadon[.]com Historical phishing domain Domain haliotisbar[.]com Histo |
| domain | hoaivt.com | hishing domain Domain cifutura[.]com Phishing domain Domain hoaivt[.]com Phishing domain Domain dronalms[.]com Phishing domain Dom |
| domain | hotelmidtownsurat.com | shing domain Domain dnsforward[.]com Phishing domain Domain hotelmidtownsurat[.]com Phishing domain Domain dataclust[.]com Phishing domain Do |
| domain | kgsscans.com | n management[.]michaelmarcotte[.]com Phishing domain Domain kgsscans[.]com Phishing domain Domain soil-management[.]com Phishing dom |
| domain | knowncontractor.com | Domain haliotisbar[.]com Historical phishing domain Domain knowncontractor[.]com Historical phishing domain Domain valtteri[.]net Historic |
| domain | konceptenterprises.com | s 45[.]32[.]64[.]165 Historical BigBear 2.0 VPS node Domain konceptenterprises[.]com Phishing domain Domain ccpipharma[.]com Phishing domain D |
| domain | management.daengrentacar.com | domain Domain valtteri[.]net Historical phishing domain URL management[.]daengrentacar[.]com/meetings Observed live Microsoft 365 phishing page File |
| domain | management.michaelmarcotte.com | ing domain Domain rootreseller[.]com Phishing domain Domain management[.]michaelmarcotte[.]com Phishing domain Domain kgsscans[.]com Phishing domain D |
| domain | offtic.com | hishing domain Domain virextec[.]com Phishing domain Domain offtic[.]com Phishing domain Domain rootreseller[.]com Phishing domain |
| domain | planisteradmin.com | in Domain captelind[.]com Historical phishing domain Domain planisteradmin[.]com Historical phishing domain Domain hnospascualfadon[.]com |
| domain | rootreseller.com | Phishing domain Domain offtic[.]com Phishing domain Domain rootreseller[.]com Phishing domain Domain management[.]michaelmarcotte[.]com |
| domain | soil-management.com | hishing domain Domain kgsscans[.]com Phishing domain Domain soil-management[.]com Phishing domain Domain daengrentacar[.]com Historical phi |
| domain | valtteri.net | ain knowncontractor[.]com Historical phishing domain Domain valtteri[.]net Historical phishing domain URL management[.]daengrentacar |
| domain | virextec.com | hishing domain Domain dronalms[.]com Phishing domain Domain virextec[.]com Phishing domain Domain offtic[.]com Phishing domain Domai |
| ipv4 | 107.191.46.14 | ddress 95[.]179[.]169[.]154 BigBear 2.0 VPS node IP address 107[.]191[.]46[.]14 BigBear 2.0 VPS node IP address 130[.]94[.]82[.]180 B |
| ipv4 | 130.94.113.184 | [.]34[.]208[.]46 Historical BigBear 2.0 VPS node IP address 130[.]94[.]113[.]184 Historical BigBear 2.0 VPS node IP address 78[.]141[. |
| ipv4 | 130.94.82.180 | address 107[.]191[.]46[.]14 BigBear 2.0 VPS node IP address 130[.]94[.]82[.]180 BigBear 2.0 VPS node IP address 38[.]54[.]124[.]58 Bi |
| ipv4 | 130.94.82.230 | ddress 208[.]76[.]222[.]214 BigBear 2.0 VPS node IP address 130[.]94[.]82[.]230 BigBear 2.0 VPS node IP address 65[.]20[.]102[.]80 Bi |
| ipv4 | 136.244.114.85 | .]176[.]72[.]180 Historical BigBear 2.0 VPS node IP address 136[.]244[.]114[.]85 Historical BigBear 2.0 VPS node IP address 70[.]34[.] |
| ipv4 | 152.39.137.60 | [.]247[.]10[.]14 Historical BigBear 2.0 VPS node IP address 152[.]39[.]137[.]60 Historical BigBear 2.0 VPS node IP address 91[.]245[. |
| ipv4 | 199.247.10.14 | .]34[.]244[.]122 Historical BigBear 2.0 VPS node IP address 199[.]247[.]10[.]14 Historical BigBear 2.0 VPS node IP address 152[.]39[. |
| ipv4 | 208.76.222.214 | address 45[.]32[.]147[.]239 BigBear 2.0 VPS node IP address 208[.]76[.]222[.]214 BigBear 2.0 VPS node IP address 130[.]94[.]82[.]230 B |
| ipv4 | 208.85.18.18 | address 38[.]54[.]124[.]58 BigBear 2.0 VPS node IP address 208[.]85[.]18[.]18 BigBear 2.0 VPS node IP address 45[.]32[.]147[.]239 B |
| ipv4 | 208.85.20.79 | address 38[.]54[.]124[.]88 BigBear 2.0 VPS node IP address 208[.]85[.]20[.]79 BigBear 2.0 VPS node IP address 95[.]179[.]169[.]154 |
| ipv4 | 38.54.124.58 | address 130[.]94[.]82[.]180 BigBear 2.0 VPS node IP address 38[.]54[.]124[.]58 BigBear 2.0 VPS node IP address 208[.]85[.]18[.]18 Bi |
| ipv4 | 38.54.124.88 | address 65[.]20[.]103[.]58 BigBear 2.0 VPS node IP address 38[.]54[.]124[.]88 BigBear 2.0 VPS node IP address 208[.]85[.]20[.]79 Bi |
| ipv4 | 38.60.250.157 | f compromise (IoCs):- Type Indicator Description IP address 38[.]60[.]250[.]157 BigBear 2.0 VPS node IP address 95[.]179[.]233[.]79 B |
| ipv4 | 45.32.147.239 | address 208[.]85[.]18[.]18 BigBear 2.0 VPS node IP address 45[.]32[.]147[.]239 BigBear 2.0 VPS node IP address 208[.]76[.]222[.]214 |
| ipv4 | 45.32.64.165 | ]245[.]235[.]208 Historical BigBear 2.0 VPS node IP address 45[.]32[.]64[.]165 Historical BigBear 2.0 VPS node Domain konceptenterpr |
| ipv4 | 64.176.72.180 | .]141[.]193[.]59 Historical BigBear 2.0 VPS node IP address 64[.]176[.]72[.]180 Historical BigBear 2.0 VPS node IP address 136[.]244[ |
| ipv4 | 65.20.102.80 | address 130[.]94[.]82[.]230 BigBear 2.0 VPS node IP address 65[.]20[.]102[.]80 BigBear 2.0 VPS node IP address 70[.]34[.]208[.]46 Hi |
| ipv4 | 65.20.103.58 | address 80[.]240[.]27[.]55 BigBear 2.0 VPS node IP address 65[.]20[.]103[.]58 BigBear 2.0 VPS node IP address 38[.]54[.]124[.]88 Bi |
| ipv4 | 70.34.208.46 | address 65[.]20[.]102[.]80 BigBear 2.0 VPS node IP address 70[.]34[.]208[.]46 Historical BigBear 2.0 VPS node IP address 130[.]94[. |
| ipv4 | 70.34.244.122 | .]244[.]114[.]85 Historical BigBear 2.0 VPS node IP address 70[.]34[.]244[.]122 Historical BigBear 2.0 VPS node IP address 199[.]247[ |
| ipv4 | 78.141.193.59 | .]94[.]113[.]184 Historical BigBear 2.0 VPS node IP address 78[.]141[.]193[.]59 Historical BigBear 2.0 VPS node IP address 64[.]176[. |
| ipv4 | 80.240.27.55 | address 95[.]179[.]233[.]79 BigBear 2.0 VPS node IP address 80[.]240[.]27[.]55 BigBear 2.0 VPS node IP address 65[.]20[.]103[.]58 Bi |
| ipv4 | 91.245.235.208 | [.]39[.]137[.]60 Historical BigBear 2.0 VPS node IP address 91[.]245[.]235[.]208 Historical BigBear 2.0 VPS node IP address 45[.]32[.] |
| ipv4 | 95.179.169.154 | address 208[.]85[.]20[.]79 BigBear 2.0 VPS node IP address 95[.]179[.]169[.]154 BigBear 2.0 VPS node IP address 107[.]191[.]46[.]14 B |
| ipv4 | 95.179.233.79 | address 38[.]60[.]250[.]157 BigBear 2.0 VPS node IP address 95[.]179[.]233[.]79 BigBear 2.0 VPS node IP address 80[.]240[.]27[.]55 Bi |
From the original article
5 min read at cybersecuritynews.com
BigBear 2. 0 is a phishing operation designed to steal proof that a user has already passed multi-factor authentication. It targets Microsoft 365 accounts through convincing sign-in links, then takes over the logged-in browser session rather than attempting to break the authentication factor.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.