ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “General Boss”

4 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPhishing & fraud 3Policy & legal 1
SeverityAllcritical 0high 3medium 0low 1info 0

BigBear phishing crew nets thousands of Microsoft 365 credentials

CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.

CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.

The Register · Security · 8d agoPhishing & fraud in the wild1

BigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials

CloudSEK researchers found the BigBear 2.0 PhaaS kit, built on Evilginx2, has stolen over 5,100 Microsoft 365 credentials across 461 organizations in 40+ countries.

CloudSEK gained admin access to the BigBear 2.0 phishing-as-a-service panel, an Evilginx2-based adversary-in-the-middle platform operated by someone using the alias 'General Boss'. The team observed 3,331 unique victim IPs across more than 40 countries, 42 VPS nodes mostly on Vultr, and 5,137 credential records across 461 organizations, including 4,148 session cookies, 1,032 plaintext passwords, and 474 completed MFA-bypassed authentications. IT and managed service providers were the most targeted sector, raising supply-chain risk since their compromise can expose client infrastructure and privileged Azure AD access.

Infosecurity Magazine · 8d agoPhishing & fraud in the wild

BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft

CloudSEK identified BigBear 2.0, an Evilginx2-based AiTM phishing operation stealing Microsoft 365 MFA session cookies, hitting 461 organizations across 40-plus countries.

The campaign proxies Microsoft sign-in pages to capture credentials and authenticated session cookies, enabling session replay into email, Teams, SharePoint, OneDrive, and connected SSO applications. CloudSEK's June 2026 discovery found 5,137 stolen records, 1,032 passwords, and 4,148 session cookies tied to 3,331 victim IPs, linked to operator 'General Boss' across 42 VPS nodes. The operation targeted IT services and managed service providers, used country-matched residential proxies, and involved at least five affiliates.

Cyber Security News · 8d agoPhishing & fraud in the wild1

Ukraine prosecutor general steps down amid scam call center bribery probe

Ukraine's prosecutor general Ruslan Kravchenko resigned amid a probe into officials who allegedly took bribes to protect fraudulent call centers.

Ukraine's prosecutor general Ruslan Kravchenko resigned over an anti-corruption probe into officials who allegedly took bribes since mid-2025 to protect fraudulent call centers; he has not been charged. NABU named five suspects, including senior prosecutor Serhii Kropyva, who was remanded with bail of 120 million hryvnias (about $2.7 million) on suspicion of laundering over 89 million hryvnias (roughly $2 million). The scam centers targeted victims in Ukraine and abroad; Ukrainian authorities reported shutting about 340 call centers over the past year, including 94 in a single week during a nationwide crackdown.

The Record · 7d agoPolicy & legal