BigBear 2.0 is Hungry for your Microsoft MFA Data

BigBear 2.0 is a phishing‑as‑a‑service (PhaaS) platform that successfully bypassed Microsoft 365 MFA at 258 organizations, stealing more than 5,000 sets of credentials and hijacking authenticated sessions across more than 40 countries. This incident matters because it demonstrates that MFA alone is no longer enough when attackers use adversary‑in‑the‑middle (AiTM) kits to steal session cookies, not just passwords.

What BigBear 2.0 Is

BigBear 2.0 is a commercialized cybercrime service that provides attackers with a turnkey phishing infrastructure. CloudSEK researchers infiltrated its admin panel and discovered:

• 42 VPS nodes dedicated to Microsoft 365 targeting

• At least five affiliate operators leasing the platform and receiving stolen credentials via Telegram bots

• A global targeting footprint across 40+ countries

How It Bypassed MFA

The attack relied on an Evilginx2-based AiTM proxy, using BigBear’s “offy” configuration:

• Victims were sent to a fake Microsoft 365 login page.

• BigBear sat between the victim and Microsoft’s real authentication service.

• When the victim entered their password and completed MFA, BigBear captured:

  • Session cookies

  • MFA tokens

  • Plaintext passwords

Once the attacker had the session cookie, they could replay it to hijack the account without needing MFA again.

This is why AiTM phishing is so dangerous: it doesn’t “break” MFA — it waits for the user to complete MFA legitimately, then steals the authenticated session.

📊 Scope of the Compromise

CloudSEK’s analysis found:

• 258 organizations compromised (out of 461 targeted)

• 5,137 credential records stolen, including:

  • 474 fully MFA‑bypassed logins

  • 1,032 plaintext passwords

  • 4,148 session cookies

• 3,331 unique IP addresses involved across 40+ countries

BigBear also used geo‑matched residential proxies in 69 countries to make stolen logins appear local, reducing fraud detection triggers.

🛠️ Additional Technical Capabilities

BigBear 2.0 included several advanced evasion features:

• FIDO2/WebAuthn interference Custom JavaScript disabled browser support for phishing‑resistant authentication, forcing users back to weaker MFA methods.

• Session hijacking automation Stolen cookies were replayed via API to immediately take over accounts.

• Real‑time credential exfiltration Affiliates received stolen credentials instantly via Telegram bots.

🧭 Why This Attack Matters

Security teams often assume MFA solves phishing. BigBear proves:

Session hijacking is now the primary frontier — not password theft. MFA does not protect session cookies.

As Shield53 notes, defenders must move beyond MFA and adopt phishing‑resistant authentication, session monitoring, and conditional access controls.

🛡️ How Organizations Should Respond

CloudSEK and other analysts recommend:

• Review Microsoft 365 sign‑in logs for unfamiliar residential IPs.

• Reset passwords for affected accounts.

• Revoke all active sessions and refresh tokens.

• Enforce FIDO2/WebAuthn where possible.

• Monitor for unexpected authentication prompts or unfamiliar login pages.

If You Want, I Can Also Provide:

• A breakdown of how AiTM phishing works

• A defensive checklist tailored to Microsoft 365 environments

• A summary you can use for internal security briefings

• A risk assessment tailored to banking/financial compliance (aligned with your IT/compliance role)

Would you like a security‑team‑ready summary or a deeper technical analysis?

deeper technical analysis

Here’s the deeper, technical, security‑team level analysis you asked for — focused on how BigBear 2.0 actually executed MFA bypass, how its AiTM stack works internally, and why Microsoft 365 is particularly exposed to this class of attack.

Deep Technical Analysis: BigBear 2.0 AiTM MFA Bypass Campaign

1. Architecture of BigBear 2.0

BigBear is not just a phishing kit — it’s a full adversary‑in‑the‑middle (AiTM) platform built around:

• Evilginx2 reverse‑proxy framework

• Custom BigBear “offy” configuration for Microsoft 365

• 42 dedicated VPS nodes for load distribution

• Geo‑matched residential proxy network (69 countries)

• Telegram bot exfiltration pipeline

Key architectural components

• Reverse proxy layer: Intercepts all traffic between victim and login.microsoftonline.com.

• Session extraction module: Parses authentication responses to extract cookies, tokens, and device IDs.

• JavaScript injection engine: Modifies Microsoft 365 login flows in real time.

• Automated session replay client: Uses stolen cookies to authenticate without MFA.

2. How BigBear Bypasses MFA Technically

BigBear does not break MFA. It captures the authenticated session after the victim completes MFA.

Step-by-step breakdown

Step 1 — Victim visits phishing URL

The phishing page is a pixel‑perfect clone of Microsoft’s login page, but the domain points to a BigBear proxy.

Step 2 — Reverse proxy relays credentials

When the victim enters their username and password:

• BigBear forwards them to Microsoft’s real login endpoint.

• Microsoft responds with an MFA challenge.

Step 3 — Victim completes MFA

This is the critical moment.

The victim approves:

• Authenticator app push

• SMS code

• Email code

• Or phone call

BigBear captures:

• POST /authorize response

• Set-Cookie headers

• Authorization tokens

• Device & session identifiers

Step 4 — BigBear extracts session cookies

The platform parses the authentication response and extracts:

• ESTSAUTH

• ESTSAUTHPERSISTENT

• x-ms-RefreshTokenCredential

• MSOID token

• AAD session cookies

These cookies represent a fully authenticated Microsoft 365 session.

Step 5 — Session replay

BigBear’s automated client uses the stolen cookies to authenticate directly to:

• Outlook Web Access

• SharePoint

• OneDrive

• Teams

• Azure Portal (in some cases)

No MFA is required because the session is already validated.

3. Why Microsoft 365 Is Vulnerable to AiTM

Microsoft 365’s authentication model relies heavily on session cookies, not continuous MFA enforcement.

Weak points exploited

• Session cookies are valid for hours or days unless explicitly revoked.

• Conditional Access often trusts session cookies once issued.

• MFA is not re‑challenged for most resource accesses.

• FIDO2/WebAuthn is optional and often disabled.

BigBear’s injected JavaScript even breaks WebAuthn, forcing users back to weaker MFA methods.

4. BigBear’s JavaScript Injection

CloudSEK found custom scripts injected into the Microsoft login flow:

Capabilities

• Disable WebAuthn API calls Prevents hardware keys from functioning.

• Modify DOM elements Forces fallback to SMS/email MFA.

• Capture keystrokes Used to steal plaintext passwords.

• Alter redirect URIs Ensures session tokens pass through the proxy.

This is more advanced than typical Evilginx deployments.

5. Automated Session Hijacking

Once credentials and cookies are stolen, BigBear’s backend:

1. Validates the cookie against Microsoft’s endpoints.

2. Uses residential proxies near the victim’s location.

3. Logs into the account silently.

4. Exfiltrates mailbox contents.

5. Creates persistence:

   • OAuth app grants

   • Inbox rules

   • Hidden forwarding rules

   • Token refresh loops

This is why many victims never notice the compromise.

6. Scale of the Attack

CloudSEK’s infiltration revealed:

• 461 organizations targeted

• 258 successfully compromised

• 5,137 credential records stolen

• 474 full MFA bypasses

• 4,148 session cookies captured

• 3,331 unique IPs used for login replay

This was not a small campaign — it was industrialized.

7. Why BigBear’s Geo‑Proxy Network Matters

Microsoft’s risk engine flags logins from unusual locations.

BigBear countered this by:

• Using residential IPs

• Matching victim’s country

• Sometimes matching city or region

This dramatically reduces detection.

8. Defensive Implications

MFA is no longer sufficient.

Session hijacking bypasses:

• SMS MFA

• Authenticator app MFA

• Email MFA

• TOTP MFA

• Push notifications

Only phishing‑resistant MFA works:

• FIDO2 hardware keys

• Windows Hello for Business

• Passkeys with device binding

Critical mitigations

• Enforce Continuous Access Evaluation (CAE)

• Require token binding

• Disable legacy authentication

• Enforce Conditional Access with device compliance

• Revoke all refresh tokens after suspected compromise

9. Why This Attack Is a Turning Point

BigBear demonstrates that:

• AiTM phishing is now commodity-level.

• MFA bypass is automated.

• Session hijacking is scalable.

• Microsoft 365 is high-value and high-risk.

This is the same class of attack used in:

• The 2022 MFA bypass campaign against Okta

• The 2023 Storm‑1167 Microsoft breach

• Multiple BEC campaigns in 2024–2026