Full Report
Researchers got inside the crooks' admin panel and found 5,137 stolen records tied to 461 organizations
Analysis Summary
# Incident Report: BigBear 2.0 Adversary-in-the-Middle Phishing Campaign
## Executive Summary
The BigBear 2.0 phishing-as-a-service (PhaaS) operation, powered by the Evilginx2 framework, successfully compromised 461 organizations by intercepting Microsoft 365 credentials and session cookies. By acting as a transparent proxy, the attackers bypassed Multi-Factor Authentication (MFA) to harvest over 5,000 records, including 474 fully authenticated sessions. The campaign remains active, utilizing residential proxies and advanced evasion techniques to facilitate Business Email Compromise (BEC) and lateral movement.
## Incident Details
- **Discovery Date:** September 8, 2026 (Reported)
- **Incident Date:** Ongoing (Active since at least July 2026)
- **Affected Organization:** 461 various organizations
- **Sector:** Multi-sector
- **Geography:** Global (69 countries targeted; residential proxies used to match victim locations)
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing
- **Vector:** Phishing / Adversary-in-the-Middle (AiTM)
- **Details:** Attackers use the "offy" template to mimic Microsoft 365 login pages, proxying the real-time authentication flow between the victim and Microsoft.
### Lateral Movement
- **Details:** While the report focuses on credential harvesting, researchers noted the stolen sessions provide a direct route into Entra ID (Azure AD), SharePoint, OneDrive, and federated SaaS applications for further movement.
### Data Exfiltration/Impact
- **Details:** 5,137 stolen records were recovered from the admin panel, including 1,032 plaintext passwords and 4,148 session cookies. 474 sessions were fully authenticated, allowing total account takeover.
### Detection & Response
- **How it was discovered:** CloudSEK researchers gained access to the attackers' administrative panel and Telegram exfiltration bots.
- **Response actions taken:** Analysis of 42 VPS nodes (26 deleted, 1 active at time of report); identification of the operator "General Boss."
## Attack Methodology
- **Initial Access:** Adversary-in-the-Middle (AiTM) phishing via Evilginx2.
- **Persistence:** Theft of long-lived session cookies to replay authenticated sessions.
- **Privilege Escalation:** Accessing Entra ID and cloud infrastructure through compromised high-privilege accounts.
- **Defense Evasion:**
- Use of residential proxy pools to match victim IP geography.
- Blocking of VPN, Datacenter, and known researcher IP ranges.
- JavaScript used to disable FIDO2/WebAuthn prompts to force weaker MFA methods (SMS/TOTP).
- **Credential Access:** Real-time interception of plaintext passwords and session tokens.
- **Discovery:** Automated scanning for Microsoft 365 environments.
- **Lateral Movement:** Using hijacked sessions to access Teams, SharePoint, and federated apps.
- **Collection:** Automated delivery of credentials via Telegram bots to five distinct affiliate operators.
- **Exfiltration:** Centralized admin panel managing 42 VPS nodes.
- **Impact:** Business Email Compromise (BEC), financial fraud, and data theft.
## Impact Assessment
- **Financial:** High potential for loss via BEC and unauthorized fund transfers.
- **Data Breach:** 5,137 records stolen across 461 organizations.
- **Operational:** Potential for complete lockout from cloud infrastructure and loss of sensitive internal communications (Teams/Email).
- **Reputational:** High risk for affected organizations due to the exposure of internal documents and files.
## Indicators of Compromise
- **Network Indicators:**
- Active phishing nodes hosted on various VPS providers (42 identified).
- Traffic routed through residential proxy networks (69 countries).
- **Behavioral Indicators:**
- JavaScript execution specifically designed to downgrade MFA options (disabling WebAuthn/FIDO2).
- Unusual login locations matching residential IPs rather than corporate offices or known VPNs.
## Response Actions
- **Containment:** Revocation of compromised session and refresh tokens.
- **Eradication:** Identification and shutdown of active VPS nodes (26 nodes previously deleted by attackers).
- **Recovery:** Forced password resets and re-enrollment of MFA for affected users.
## Lessons Learned
- **MFA Vulnerability:** Standard MFA (SMS, Push, TOTP) is no longer sufficient to stop AiTM attacks.
- **Evasion Sophistication:** Attackers are successfully using residential proxies to bypass "impossible travel" or geographic location alerts.
- **PhaaS Maturity:** The "General Boss" operator has successfully commercialized AiTM, allowing affiliates to scale attacks easily.
## Recommendations
- **Phishing-Resistant MFA:** Transition all users to FIDO2/WebAuthn (security keys) or Windows Hello for Business.
- **Conditional Access:** Implement policies that require "Compliant Devices" or "Microsoft Entra Joined" devices to access sensitive resources.
- **Session Limits:** Reduce session lifetimes and implement continuous access evaluation (CAE).
- **Monitoring:** Set alerts for MFA "downgrade" attempts or sessions initiated from residential proxy ranges.