CloudSEK reported a phishing-as-a-service operation (“BigBear 2.0”) that tricks Microsoft 365 users into signing in and completing MFA on a lookalike login page. Even though MFA succeeds, the attackers capture the authenticated session cookie and reuse it to access the victim’s Microsoft 365 session without needing another MFA prompt. The campaign targeted hundreds of organizations globally, with IT services and managed service providers heavily represented.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You sign in to Microsoft 365, approve MFA, everything looks fine… but someone else is now in your mailbox too. That’s BigBear 2.0. You get an email: “Action required: Sign in to Microsoft 365 to continue.” The link opens a perfect-looking login, but the URL isn’t Microsoft. You sign in, complete MFA, and an Evilginx2 attacker-in-the-middle proxy quietly steals your authenticated session cookie. CloudSEK found thousands of stolen Microsoft 365 session cookies from 461 organizations. BigBear even tries to hide FIDO2 and WebAuthn options to push you into easier-to-phish OTP or push MFA. Residential proxies then replay your cookie from your country, so the login looks normal in logs. Here’s the move: if you ever get an unexpected Microsoft 365 sign-in or MFA prompt, do not click the email link, go to office.com yourself, sign in, and if you didn’t start it, report it immediately as a suspicious sign-in.
The article describes a real phishing investigation where attackers used an adversary-in-the-middle (AiTM) proxy to relay a genuine Microsoft sign-in and steal both credentials and the victim’s live session token. The lure came from a legitimately compromised corporate mailbox, making common email…
Microsoft disrupted EvilTokens, a phishing-as-a-service operation linked to thousands of compromised Microsoft 365 inboxes. The group used “device code” phishing to steal valid session tokens (not passwords) and then used an AI chatbot to scan mailboxes and help craft business email compromise…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
Researchers say the “BigBear 2.0” phishing-as-a-service operation compromised Microsoft 365 accounts by stealing authenticated session cookies after users completed MFA normally. This let attackers replay the session and access accounts without triggering another MFA prompt, impacting 258…
Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
