BigBear 2.0 Phishing Operation Hijacks Thousands of Microsoft 365 Accounts
CloudSEK researchers expose a phishing-as-a-service operation using AiTM proxies to bypass multi-factor authentication across hundreds of organizations.
Security researchers at CloudSEK have exposed the inner workings of 'BigBear 2.0,' a sophisticated phishing-as-a-service (PhaaS) operation targeting Microsoft 365 users. The campaign successfully bypassed multi-factor authentication (MFA) to hijack corporate accounts, demonstrating a growing threat to cloud-based identity security.
After gaining access to the operation's admin panel, researchers discovered 5,137 stolen records linked to 461 different organizations. The stolen data included 1,032 plaintext passwords and 4,148 session cookies. Most critically, 474 of these records were identified as complete MFA-bypassed authentications, allowing attackers to hijack active sessions. To evade detection and avoid triggering geographic security alerts during logins, the operation utilized a residential proxy pool spanning 69 countries.
The Mechanics of the Attack
BigBear 2.0 employs an adversary-in-the-middle (AiTM) strategy powered by an Evilginx2 proxy. In this setup, the attacker's server sits between the victim and the legitimate Microsoft login page, capturing credentials and session cookies in real-time. By stealing the session cookie returned by Microsoft after a successful MFA challenge, the attacker can replay the authenticated session. This allows the adversary to access Microsoft 365 services without prompting the victim to authenticate again.
To increase their success rate, the crew implemented custom JavaScript on their phishing pages to specifically disable FIDO2/WebAuthn authentication. This forced users toward less secure MFA methods, such as SMS or TOTP, which are susceptible to AiTM interception.
Industry Implications
This campaign highlights a critical vulnerability in traditional MFA deployments. While SMS, push notifications, and TOTP codes provide a baseline of security, they are insufficient against modern AiTM attacks that target the session token rather than the password.
Once a session is hijacked, attackers gain unfettered access to a user's emails, Teams chats, SharePoint files, and OneDrive storage. This level of access frequently leads to Business Email Compromise (BEC), where attackers use legitimate accounts to authorize fraudulent payments or move laterally into deeper cloud infrastructure to steal sensitive corporate data.
The Operation's Structure
The infrastructure was managed by an operator using the alias 'General Boss,' who leased the phishing capabilities to at least five affiliate operators. These affiliates managed their campaigns and delivery via Telegram bots, illustrating the commoditization of high-end phishing tools.
Security experts emphasize that the only effective defense against these techniques is the adoption of phishing-resistant authentication, such as FIDO2/WebAuthn, which binds the authentication process to the specific origin of the website, preventing proxy-based theft.