-
A phishing-as-a-service tool called BigBear 2.0 has successfully bypassed multi-factor authentication at 258 organizations, stealing over 5,000 Microsoft 365 credentials.
-
The tool sits silently between victims and Microsoft’s login system, grabbing passwords and session cookies even after users complete their security checks.
-
Researchers who got inside the control panel found 42 active servers, five criminal operators, and a live operation still running across 40 countries at the time of discovery.
Hackers no longer need to be experts to pull off a major cyberattack. They just need to rent the right tool.
A phishing-as-a-service framework called BigBear 2.0 has hit 258 organizations and stolen more than 5,000 Microsoft 365 login details. Cybersecurity researchers at CloudSEK discovered the operation after gaining admin access to the tool’s own control panel.
What they found inside was alarming. The platform was running 42 VPS (virtual private server) nodes. All of them were set up to attack Microsoft 365 accounts.
How BigBear 2.0 Got Past Security Checks
Most people think multi-factor authentication (MFA) keeps their accounts safe. BigBear 2.0 proved that idea wrong.
The tool uses a setup built on Evilginx2, a known adversary-in-the-middle framework. It places itself between the victim and Microsoft’s real login page. When a user types in their password and completes their MFA check, BigBear 2.0 grabs everything in real time.
The tool uses a specific setup called “offy.” This creates a middleman connection between the victim and Microsoft’s login system. The attacker captures the password, the MFA approval, and the session cookie. They then use that cookie to log into the account as if they were the real user.
A session cookie is like a digital pass. Once you log in, websites give your browser this pass so you do not have to log in again. BigBear 2.0 steals that pass and uses it to walk straight into your account.
Microsoft 365 is not just one app. It covers Email (Exchange Online), Teams, SharePoint, OneDrive, and the Entra ID login system. Breaking into one Microsoft 365 account can open the door to all of these at once. It can also give attackers access to other connected apps through a feature called single sign-on.
BigBear 2.0 also targets stronger security methods. According to CloudSEK, the tool runs custom code (JavaScript) that blocks a security feature called FIDO2 and WebAuthn. These are stronger login methods that are harder to crack. BigBear 2.0 quietly disables them in the browser. This forces the victim to use a weaker login method instead, one that BigBear 2.0 can more easily steal.
To avoid getting caught, the platform uses residential proxy addresses from 69 countries. It matches the victim’s location with a local IP address. Microsoft’s servers see a login coming from a nearby, normal-looking address. So they do not flag it as suspicious.
Inside the Control Panel: 5,000 Stolen Records and Five Criminal Operators
CloudSEK did not just watch from the outside. Researchers got inside BigBear 2.0’s admin panel. What they found showed exactly how much damage the tool had already done.
According to CloudSEK’s report shared with BleepingComputer, the panel had collected 5,137 credential records by the time researchers accessed it. That number breaks down into 474 fully completed MFA bypasses, 1,032 plaintext (unencrypted) passwords, and 4,148 session cookies. The stolen data came from 3,331 unique victim devices spread across more than 40 countries.
CloudSEK also found that at least five separate criminal operators were renting and using the BigBear 2.0 platform. Each operator received stolen login details in real time through live Telegram bots. This kind of setup, where a criminal rents a hacking tool to other criminals, is called phishing-as-a-service (PhaaS). It is a growing trend that puts advanced attack tools in the hands of low-level hackers.
Another PhaaS platform, Kali365, exploits Microsoft’s legitimate OAuth 2.0 device authorization flow, tricking victims into entering phishing-supplied device codes on Microsoft’s genuine login page to capture MFA-approved OAuth tokens.
While 461 organizations appeared in the wider target list, CloudSEK confirmed that 258 of them had at least one fully completed MFA bypass. That means attackers successfully got into at least one account in each of those 258 organizations.
What Affected Organizations Should Do Right Now
CloudSEK reported the operation to law enforcement. The company also contacted several of the affected organizations directly and included the stolen credentials in responsible disclosure reports.
At the time CloudSEK published its findings, BigBear 2.0’s admin panel was still online. The phishing servers, however, had been offline for nearly three weeks.
Organizations that BigBear 2.0 may have targeted need to act fast. They should reset all exposed passwords immediately. They also need to cancel active login sessions, clear refresh tokens, and force all high-level account holders to log in again from scratch.
Going forward, organizations should switch to phishing-resistant login methods, specifically FIDO2 and WebAuthn security keys, since BigBear 2.0 actively tried to disable them.
Setting up Conditional Access policies that require company-managed devices is also a smart move. Relying on location-based signals alone is not enough, as BigBear 2.0 already showed it can fake those too.
