A phishing-as-a-service platform called BigBear 2.0 has compromised Microsoft 365 accounts at 258 organizations, stealing more than 5,000 sets of credentials even from users who had multi-factor authentication turned on. Researchers at CloudSEK gained access to the service’s administration panel and found 42 virtual servers running continuously, all pointed at Microsoft 365 targets. The operation had exfiltrated 5,137 credential records — including 474 complete MFA-bypassed logins, 1,032 plaintext passwords, and 4,148 session cookies — from victims in more than 40 countries.
BigBear works by placing itself invisibly between the victim and Microsoft’s real login page, a technique known as adversary-in-the-middle (AiTM). When someone types their password and approves their MFA prompt, BigBear captures both the credentials and the authenticated session cookie that Microsoft hands back. That cookie is then replayed to hijack the account without needing the password or MFA again. To avoid triggering Microsoft’s fraud detection, the platform routes traffic through residential proxies matched to the victim’s own country, so the login looks local. The service is leased to at least five affiliate operators who receive stolen credentials in real time via Telegram bots. CloudSEK has notified law enforcement and a number of the affected organizations, and says the phishing infrastructure was taken offline around three weeks ago — though the administration panel was still online at the time of its report.
How to check if you’re affected
Affected products include any Microsoft 365 subscription — Business, Enterprise, or Education — where users may have encountered unfamiliar login screens or unexpected authentication prompts over the past several months. Administrators should review the Microsoft 365 sign-in logs (via the Entra admin center or Microsoft 365 Defender) for logins from unfamiliar IP addresses, especially residential-looking addresses that match the user’s geography but don’t correspond to known offices or VPNs.
If suspicious sign-ins are found, the recommended steps are: reset the exposed account’s password, revoke all active sessions and refresh tokens, and force re-authentication for high-privilege accounts. Going forward, enforce phishing-resistant FIDO2/WebAuthn authentication where possible — BigBear was found to actively interfere with FIDO2 to push users toward weaker MFA methods, so enabling hardware security keys or passkeys removes this vector. Conditional Access policies that require managed, compliant devices add another layer that session-cookie replay cannot bypass.