Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to Telegram bots and used for automated cookie replay. IT service providers and managed service providers were highlighted as the most-targeted sector, increasing supply-chain risk.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Action required: Microsoft 365 sign-in needed to continue.” Looks normal, right? Behind that link is BigBear 2.0, a phishing-as-a-service built on Evilginx2. It shows you a perfect Microsoft 365 page, steals your password and session cookie, and then replays it to bypass your MFA. Researchers say BigBear 2.0 already grabbed over 5100 Microsoft 365 credential records, more than 4000 session cookies and hundreds of MFA-bypassed logins, hitting IT and managed service providers hardest, which then puts their clients at risk too. Here’s your move: if you get a Microsoft 365 sign-in link by email, don’t click it, close the email, open your saved Microsoft 365 bookmark, and sign in there instead.
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers say the “BigBear 2.0” phishing-as-a-service operation compromised Microsoft 365 accounts by stealing authenticated session cookies after users completed MFA normally. This let attackers replay the session and access accounts without triggering another MFA prompt, impacting 258…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
