First identified in June 2026, the operation targeted Microsoft 365 users and was reportedly still active during the investigation.
Researchers gained administrative access to the campaign’s management panel and found it had controlled 42 virtual private server nodes during its lifecycle.
Most of the servers were hosted by Vultr, operated by The Constant Company LLC. The platform used an Evilginx2 phishing template, called “offy,” designed specifically to proxy Microsoft 365 authentication sessions.
The panel reportedly collected 5,137 records from 3,331 unique victim IP addresses across more than 40 countries. India accounted for the largest share, followed by France, Saudi Arabia, New Zealand, and Germany.
The data included 1,032 plaintext passwords, 4,148 session cookies, and 474 completed authentications where multi-factor authentication was successfully bypassed.
BigBear 2.0 appears to operate as a multi-tenant service leased to affiliates. At least five operators received stolen credentials and session data through dedicated Telegram bots in real time. The operator behind the service reportedly used the alias “General Boss.”
BigBear 2.0 Bypasses MFA
Unlike ordinary credential phishing, BigBear 2.0 uses an adversary-in-the-middle proxy. Victims are sent to a phishing domain that displays a proxied version of the legitimate Microsoft sign-in page.
The proxy silently relays traffic between the victim and Microsoft while recording credentials and authentication tokens. After a victim enters a password and completes an MFA prompt, Microsoft issues a valid authenticated session cookie.
BigBear 2.0 captures this cookie before it reaches the victim’s browser. Attackers can then replay the stolen session in their own browser and access the victim’s Microsoft 365 account without needing the password, MFA code, or push approval again.
This technique can expose Outlook mailboxes, Teams chats, SharePoint files, OneDrive data, Entra ID resources, and connected single sign-on applications.
It also creates a path for business email compromise, internal phishing, cloud reconnaissance, data theft, and ransomware operations. The campaign used geo-matched residential proxy infrastructure across 69 countries.
This allowed the phishing platform to route traffic through an IP address in the victim’s country, reducing the chance that location-based security controls or suspicious-login alerts would block the session.
CloudSEK also identified custom JavaScript modifications that disabled FIDO2 and WebAuthn options on phishing pages, forcing victims toward weaker MFA methods such as SMS, one-time passwords, or push approvals.
Other code blocked Microsoft anti-phishing telemetry and automatically enabled the “Keep Me Signed In” setting to extend session lifetime, CloudSEK said.
Indicators of Compromise
| IP Address (Defanged) | Type | Status |
|---|---|---|
| 38[.]60[.]250[.]157 | VPS node | Active/observed |
| 95[.]179[.]233[.]79 | VPS node | Active/observed |
| 80[.]240[.]27[.]55 | VPS node | Active/observed |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
