As reported by BleepingComputer, researchers at CloudSEK infiltrated the BigBear 2.0 phishing-as-a-service (PhaaS) control panel and uncovered a operation that has compromised Microsoft 365 credentials at 258 organizations, exfiltrating over 5,000 credential records including nearly 500 fully MFA-bypassed authentication sessions. The scale and sophistication of this campaign demand attention from every security team relying on Microsoft 365 as its identity backbone.

Threat Alert: As reported by BleepingComputer, researchers at CloudSEK infiltrated the BigBear 2.0 phishing-as-a-service (PhaaS) control panel and uncovered a operation that has compromised Microsoft 365 credentials at 258 organizations, exfiltrating over 5,000 credential records including nearly 500 fully MFA-bypassed authentication sessions.

Why This Matters More Than Another Phishing Story

The cybersecurity industry has spent years telling organizations that MFA solves the phishing problem. BigBear 2.0 is the latest proof that adversary-in-the-middle (AiTM) phishing has industrialized that assumption into a liability. The kit, built on Evilginx2, does not defeat MFA cryptographically — it simply waits for the victim to complete MFA legitimately, then steals the resulting session cookie and replays it. The attacker never needs the second factor.

The panel exfiltrated 4,148 session cookies — the true currency of this attack. Credentials are almost incidental when the authenticated session itself is portable.

What elevates BigBear above typical AiTM kits is its operational maturity: geo-matched residential proxies across 69 countries to evade Microsoft's impossible-travel detection, at least five affiliate operators receiving stolen data in real time via Telegram bots, and custom JavaScript that actively interferes with FIDO2/WebAuthn prompts to force victims toward weaker authentication paths.

The FIDO2 Interference Technique Deserves Scrutiny

The most strategically significant detail in CloudSEK's findings is that BigBear ships JavaScript designed to disable browser functionality supporting FIDO2/WebAuthn. This is not a cryptographic defeat of passkeys — it is a downgrade attack that prevents the stronger factor from being offered in the first place. It works because the attacker controls the rendered page inside the reverse proxy.

This has two implications defenders should internalize:

  • FIDO2 remains phishing-resistant in principle — when it is actually invoked. The protection breaks down if the user never sees the WebAuthn prompt because the attacker suppressed it.
  • Conditional Access policies must enforce phishing-resistant MFA rather than merely permitting it. If tenants allow SMS, OTP, or push as fallback methods, attackers like BigBear will route users toward those weaker options.

Who Is at Risk

Any organization using Microsoft 365 as a primary identity provider is exposed. The 258 confirmed compromises span 40+ countries and include entities of varying size — the limiting factor is not target selection but affiliate effort. Small and midsize businesses with Microsoft 365 Business Premium and minimal Conditional Access tuning are disproportionately vulnerable because they lack the telemetry and policy granularity of enterprise tenants.

Sectors where email is the gateway to business operations — legal, financial services, healthcare, and managed service providers — face elevated risk because a single compromised session can pivot into supply chain fraud, data exfiltration, or follow-on BEC.

Shield53 Recommendations: What You Should Do

Immediate Actions

Shield53 Recommendations: What You Should Do
Enforce phishing-resistant MFA in Conditional Access. Require FIDO2 security keys or Windows Hello for Business for all users. Disable SMS, voice, and OTP methods. Block legacy authentication entirely.
Implement session token binding and session controls. In Entra ID Conditional Access, configure session frequency and sign-in frequency policies. Consider requiring reauthentication for high-risk access.
Deploy or tune session anomaly detection. Monitor Entra ID sign-in logs for impossible travel, unfamiliar IP ranges, and token replay indicators. BigBear's residential proxies make geo-mismatch unreliable — focus on device fingerprint and token issuance anomalies instead.
Hunt for compromised sessions now. Search Entra ID sign-in logs for the past 90 days for sessions originating from residential proxy IP ranges or showing authentication from IPs inconsistent with the user's registered devices. Revoke refresh tokens for any suspicious accounts.
Block known Evilginx2 phishing infrastructure. Subscribe to threat intel feeds tracking AiTM kit domains. BigBear used 42 VPS nodes — these rotate frequently, so domain age and TLS certificate patterns are better indicators than static blocklists.

Strategic Hardening

  • Adopt passkeys with enforced attestation. Entra ID supports FIDO2 security keys with AAGUID allowlisting. Require attested keys and reject unattested authenticators.
  • Deploy Continuous Access Evaluation (CAE). CAE enables near-real-time revocation of access tokens when risk conditions change, shrinking the window for session cookie replay.
  • Implement email security that inspects authentication flow, not just content. Traditional SEGs miss AiTM phishing because the lure domains are short-lived. Consider browser isolation or secure email gateways with real-time URL rewriting and click-time analysis.
  • Train users on the visual indicators of AiTM phishing. The URL bar is the last reliable signal. Teach users to verify they are on login.microsoftonline.com directly, not a proxied lookalike.

The broader lesson is that MFA was never the destination — it was a waypoint. PhaaS operations like BigBear have commodified session theft, and the defender's advantage now lives in session lifecycle management, phishing-resistant authenticators that cannot be downgraded, and identity telemetry that detects replay after the fact. Organizations still treating MFA enrollment as a compliance checkbox are operating on an outdated threat model.