Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to Telegram bots and used for automated cookie replay. IT service providers and managed service providers were highlighted as the most-targeted sector, increasing supply-chain risk.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Action required: Microsoft 365 sign-in needed to continue.” Looks normal, right? Behind that link is BigBear 2.0, a phishing-as-a-service built on Evilginx2. It shows you a perfect Microsoft 365 page, steals your password and session cookie, and then replays it to bypass your MFA. Researchers say BigBear 2.0 already grabbed over 5100 Microsoft 365 credential records, more than 4000 session cookies and hundreds of MFA-bypassed logins, hitting IT and managed service providers hardest, which then puts their clients at risk too. Here’s your move: if you get a Microsoft 365 sign-in link by email, don’t click it, close the email, open your saved Microsoft 365 bookmark, and sign in there instead.
Researchers say the “BigBear 2.0” phishing-as-a-service operation compromised Microsoft 365 accounts by stealing authenticated session cookies after users completed MFA normally. This let attackers replay the session and access accounts without triggering another MFA prompt, impacting 258…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
A phishing-as-a-service toolkit called Mirage2FA has been targeting organizations by abusing real Microsoft 365 login pages through a man-in-the-middle proxy. The attackers capture usernames, passwords, and live two-factor authentication codes, then take over the user’s session using stolen session…
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
Barracuda researchers simulated how an attacker who already compromised one employee mailbox could use the account’s built-in email AI assistant to hide evidence, learn org context, and draft convincing internal phishing emails. In their proof of concept, the attacker used an invoice-themed link to…
