Researchers say the “BigBear 2.0” phishing-as-a-service operation compromised Microsoft 365 accounts by stealing authenticated session cookies after users completed MFA normally. This let attackers replay the session and access accounts without triggering another MFA prompt, impacting 258 organizations with confirmed MFA-bypass compromises.
The BigBear 2.0 operation, reported by CloudSEK, did not try to defeat multifactor authentication directly. Instead, victims were lured to a lookalike Microsoft 365 sign in page that acted as a phishing proxy. The victim entered credentials and completed MFA exactly as they normally would. Because the login flow appeared legitimate, the proxy sat between the victim and Microsoft, capturing the authenticated session cookie issued after successful login. That cookie could then be replayed by the attacker, granting access to the account without ever triggering a second MFA prompt.
CloudSEK's access to an admin panel tied to the operation showed the scale involved: thousands of session cookies, plaintext passwords, and completed MFA bypassed authentications across hundreds of targeted organizations. Residential proxies spread across dozens of countries helped disguise suspicious logins as normal geographic activity, while custom JavaScript on the phishing pages could disable FIDO2 or WebAuthn options, steering victims toward weaker, more interceptable authentication methods.
The technique succeeded because it exploited trust in the MFA process itself rather than trying to break it. Employees are trained to treat a completed MFA challenge as a sign that a login is safe, but this campaign shows that a successful MFA prompt cannot automatically be treated as proof that a session is trustworthy. Once the session cookie is stolen, MFA has already served its purpose and offers no further protection against replay.
The presence of at least five affiliate operators receiving stolen data through separate Telegram bots also points to an organized, service based model that could scale across many targets, including IT services and MSPs, whose compromise can extend risk to their downstream customers.
Defenders should enforce phishing resistant authentication such as FIDO2 or WebAuthn rather than simply offering it as an option, since this campaign specifically targeted weaker methods. Conditional Access policies that require managed or compliant devices can reduce reliance on location signals, which the operation's residential proxies were designed to undermine. When compromise is suspected, organizations should revoke active sessions and refresh tokens, force affected users to reauthenticate, and reset any exposed passwords promptly to limit the window in which stolen session cookies remain useful to an attacker.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It used an adversary-in-the-middle proxy so victims completed MFA normally, then captured the authenticated session cookie issued by Microsoft and replayed it, giving attackers access without triggering another MFA prompt.
CloudSEK found custom JavaScript on the phishing pages that could disable FIDO2/WebAuthn functionality, which may push victims toward more interceptable authentication methods.
Organizations that detect related activity should revoke active sessions and refresh tokens, force affected users to reauthenticate, and reset exposed passwords.
CloudSEK identified 151 organizations in the IT services/MSP category among the targets, which raises downstream risk for their customers.
You can do MFA perfectly…and BigBear 2.0 can still walk into your Microsoft 365 account. BigBear 2.0 is a phishing-as-a-service kit using Evilginx2. You see a perfect-looking 'Sign in to Microsoft 365' page, enter your password, approve MFA…and their proxy quietly steals your authenticated session cookie. Here’s the twist: instead of cracking MFA, they let you complete it. Then they replay that cookie from residential IPs in 69 countries, so logins look local. Your security key option might even vanish, because their JavaScript disables FIDO2 and WebAuthn. If anything feels off with a Microsoft 365 login or you spot odd activity after MFA, don’t just trust the prompt, report it and have IT revoke all active sessions for that account immediately.
Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
A phishing-as-a-service toolkit called Mirage2FA has been targeting organizations by abusing real Microsoft 365 login pages through a man-in-the-middle proxy. The attackers capture usernames, passwords, and live two-factor authentication codes, then take over the user’s session using stolen session…
CloudSEK reported a phishing-as-a-service operation (“BigBear 2.0”) that tricks Microsoft 365 users into signing in and completing MFA on a lookalike login page. Even though MFA succeeds, the attackers capture the authenticated session cookie and reuse it to access the victim’s Microsoft 365…
A legal-sector threat intel report says adversary-in-the-middle (AiTM) phishing is now the most common way attackers gain initial access to law firms, because it can bypass MFA by stealing valid session cookies. The report highlights deadline-driven lures (fake document/court portal errors) and…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
