Full Report
A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials. [...]
Analysis Summary
# Incident Report: BigBear 2.0 PhaaS MFA Bypass Campaign
## Executive Summary
The BigBear 2.0 Phishing-as-a-Service (PhaaS) framework successfully targeted 258 organizations, compromising over 5,000 Microsoft 365 credentials. The campaign utilized an Adversary-in-the-Middle (AiTM) framework to bypass multi-factor authentication (MFA) and hijack authenticated sessions. While phishing infrastructure is currently offline, the administration panel remains active, and the threat persists through multiple affiliate operators.
## Incident Details
- **Discovery Date:** September 2026 (Reported)
- **Incident Date:** Ongoing (Active at time of report)
- **Affected Organization:** 258 distinct organizations compromised; 461 targeted
- **Sector:** Multi-sector
- **Geography:** Global (Targeting victims across 40+ countries)
## Timeline of Events
### Initial Access
- **Date/Time:** September 2026 and prior
- **Vector:** Phishing via Adversary-in-the-Middle (AiTM) proxy
- **Details:** Attackers deployed the "offy" configuration of the BigBear 2.0 framework to proxy traffic between victims and legitimate Microsoft 365 login pages.
### Lateral Movement
- **Details:** Once session cookies were captured, attackers utilized them to hijack active Microsoft 365 sessions, potentially gaining access to Exchange Online, Teams, SharePoint, and OneDrive to move laterally within the cloud environment.
### Data Exfiltration/Impact
- **Details:** Exfiltration of 5,137 credential records, including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies.
### Detection & Response
- **How it was discovered:** Researchers at CloudSEK gained administrator access to the BigBear control panel.
- **Response actions taken:** CloudSEK notified law enforcement and affected organizations; credentials were included in responsible-disclosure reports.
## Attack Methodology
- **Initial Access:** Phishing via AiTM (Evilginx2-based) frameworks.
- **Persistence:** Session cookie hijacking allows continued access without re-authentication.
- **Privilege Escalation:** Targeting high-privileged accounts to gain broader organizational access.
- **Defense Evasion:** Use of geo-matched residential proxies (69 countries) to mimic victim locations and bypass Microsoft's location-based security alerts.
- **Credential Access:** Capture of plaintext passwords and MFA-authenticated session cookies.
- **Discovery:** Custom JavaScript used to detect and disable FIDO2/WebAuthn browser functionality.
- **Lateral Movement:** Replaying captured cookies through APIs to hijack sessions across the M365 ecosystem.
- **Collection:** Automated exfiltration via Telegram bots to five distinct affiliate operators.
- **Exfiltration:** Real-time data transfer to operator-controlled Telegram channels.
- **Impact:** Complete account takeover and bypass of standard MFA (SMS/Push/TOTP).
## Impact Assessment
- **Financial:** Not disclosed, but involves potential business email compromise (BEC) losses.
- **Data Breach:** Over 5,000 Microsoft 365 credentials and session tokens stolen from 3,331 unique victim IPs.
- **Operational:** Potential disruption of email and cloud collaboration services for 258 organizations.
- **Reputational:** High risk for affected organizations due to the scale of the compromise and loss of sensitive data.
## Indicators of Compromise
- **Network indicators:** Infrastructure utilized 42 VPS nodes for targeting (specific IPs/URLs defanged in original reports: e.g., `hxxp[://]bigbear-panel[.]com`).
- **File indicators:** Custom JavaScript ("offy" configuration) designed to interfere with WebAuthn.
- **Behavioral indicators:** Authentication attempts from residential proxy IPs that match the victim's geography but deviate from known device fingerprints.
## Response Actions
- **Containment measures:** Phishing infrastructure taken offline (approx. late August 2026).
- **Eradication steps:** Recommended resetting of all exposed passwords and revoking of active session tokens.
- **Recovery actions:** Forcing re-authentication for all high-privileged accounts.
## Lessons Learned
- **MFA Vulnerability:** Standard MFA (SMS, Push, TOTP) is insufficient against sophisticated AiTM attacks.
- **Detection Gaps:** Geo-location signals are easily spoofed by modern PhaaS frameworks using residential proxies.
- **Feature Interference:** Attackers are actively degrading browser security features (FIDO2/WebAuthn) to force users into weaker authentication paths.
## Recommendations
- **Phishing-Resistant MFA:** Implement FIDO2/WebAuthn-based hardware security keys (e.g., YubiKeys) which are resistant to AiTM proxying.
- **Device-Based Conditional Access:** Transition from geo-location requirements to policies that require "Managed" or "Compliant" devices.
- **Session Management:** Shorten session lifetimes and implement continuous access evaluation (CAE) to revoke tokens upon suspicious changes.
- **Monitoring:** Monitor for unusual user-agent strings or attempts to downgrade authentication methods at the login portal.