CloudSEK reported a phishing-as-a-service operation (“BigBear 2.0”) that tricks Microsoft 365 users into signing in and completing MFA on a lookalike login page. Even though MFA succeeds, the attackers capture the authenticated session cookie and reuse it to access the victim’s Microsoft 365 session without needing another MFA prompt. The campaign targeted hundreds of organizations globally, with IT services and managed service providers heavily represented.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You sign in to Microsoft 365, approve MFA, everything looks fine… but someone else is now in your mailbox too. That’s BigBear 2.0. You get an email: “Action required: Sign in to Microsoft 365 to continue.” The link opens a perfect-looking login, but the URL isn’t Microsoft. You sign in, complete MFA, and an Evilginx2 attacker-in-the-middle proxy quietly steals your authenticated session cookie. CloudSEK found thousands of stolen Microsoft 365 session cookies from 461 organizations. BigBear even tries to hide FIDO2 and WebAuthn options to push you into easier-to-phish OTP or push MFA. Residential proxies then replay your cookie from your country, so the login looks normal in logs. Here’s the move: if you ever get an unexpected Microsoft 365 sign-in or MFA prompt, do not click the email link, go to office.com yourself, sign in, and if you didn’t start it, report it immediately as a suspicious sign-in.
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
Researchers say the “BigBear 2.0” phishing-as-a-service operation compromised Microsoft 365 accounts by stealing authenticated session cookies after users completed MFA normally. This let attackers replay the session and access accounts without triggering another MFA prompt, impacting 258…
Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to…
A phishing-as-a-service toolkit called Mirage2FA has been targeting organizations by abusing real Microsoft 365 login pages through a man-in-the-middle proxy. The attackers capture usernames, passwords, and live two-factor authentication codes, then take over the user’s session using stolen session…
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
