BigBear 2.0: Phishing Service Bypassed MFA at 258 Organizations

Researchers at CloudSEK have detailed the workings of the BigBear 2.0 phishing platform, which made it possible to bypass multi-factor authentication (MFA) and compromise Microsoft 365 accounts at hundreds of organizations. The specialists gained administrative access to the service's control panel and were able to study it from the inside.

How the Attack Works

At the heart of BigBear lies an adversary-in-the-middle (AiTM) framework built on Evilginx2. A configuration named “offy” deploys a proxy between the victim and Microsoft's real authentication infrastructure. When a user enters their login and password and passes the MFA check, the platform intercepts not only the credentials but also the authorized session cookie. These cookies are then replayed through the API, and the attacker seizes an already-verified session — in effect, MFA becomes useless.

The fight against strong protection methods deserves particular attention. The platform uses purpose-written JavaScript that interferes with FIDO2/WebAuthn, disabling the corresponding browser functionality and forcing the victim to switch to weaker authentication methods.

To avoid raising suspicion with Microsoft's servers, BigBear employs residential proxies with geolocation targeting for 69 countries: the victim's activity is accompanied by an IP address that matches their actual location, and so is not flagged as anomalous.

Scale of the Operation

According to CloudSEK, the infrastructure included 42 VPS nodes entirely aimed at Microsoft 365. The panel yielded 5,137 credential records, among them 474 fully completed MFA bypasses, 1,032 plaintext passwords and 4,148 session cookies. There were 3,331 unique victim IP addresses in more than 40 countries affected. Of the 461 organizations included in the overall target set, at least one successful MFA-bypass compromise was recorded at 258 separate companies.

The service operates on a rental model: at least five affiliated operators obtained access to the multi-user panel, and each of them received the stolen data in real time through Telegram bots.

What to Do

CloudSEK has notified law enforcement and some of the affected organizations. At the time of publication, the administrative panel was still online, whereas the phishing infrastructure itself had been unavailable for nearly three weeks.

Potential victims are advised to reset compromised passwords, revoke active sessions, refresh tokens and force re-authentication of privileged accounts. As a preventive measure, it is suggested that organizations adopt phishing-resistant FIDO2/WebAuthn authentication and conditional access policies requiring managed devices, rather than relying on geolocation signals.

Source: Bleeping Computer