Reported by 8 outlets

Timeline

1. original reporting

   📰 'BigBear 2.0' Phishing Service Bypasses MFA in Global M365 Campaign Global PhaaS 'BigBear 2.0' uses custom Evilginx2 to bypass MFA in Micr

   cyber.netsecops.io · 35d ago · September 8th, 2026

   📰 'BigBear 2.0' Phishing Service Bypasses MFA in Global M365 Campaign Global PhaaS 'BigBear 2.0' uses custom Evilginx2 to bypass MFA in Micr

   via Mastodon https://cyber.netsecops.io/articles/bigbear-2-0-phishing-service-bypasses-mfa-in-global-m365-campaign/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

2. update from bleepingcomputer.com

   BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

   bleepingcomputer.com · 36d ago · September 7th, 2026

   A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials. Researchers at cybersecurity company CloudSEK gained administrator access to the control panel and found that the service managed 42 VPS nodes, all configured to target Microsoft 365 as part of the observed operation. According to the researchers, the campaign uses an Evilginx2-based adversary-in-the-middle framework to intercept passwords and authenticated session cookies, allowing attackers to hijack accounts after victims complete the multi-factor authentication (MFA) process. BigBear uses a configuration called “offy” that sets up a man-in-the-middle (AiTM) proxy between the victim and Microsoft’s legitimate authentication infrastructure. This allows the attacker to capture credentials, including MFA, and session cookies and replay them through an API to hijack the victim’s authentication session. Campaign timeline Source: CloudSEK Microsoft 365 is Microsoft's cloud productivity and identity ecosystem, incorporating services such as Exchange Online, Teams, SharePoint, OneDrive, and Entra ID authentication. Compromising an authenticated Microsoft 365 session can expose email and files while potentially providing access to other applications connected through single sign-on. According to CloudSEK, BigBear proved to be sufficiently successful to compromise hundreds of entities and capture thousands

3. mentioned by malware.news

   BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

   malware.news · 36d ago · September 7th, 2026

4. update from cyberpress.org

   BigBear 2.0 Phishing Campaign Hijacks Microsoft 365 Sessions to Bypass MFA

   cyberpress.org · 35d ago · September 8th, 2026

   First identified in June 2026, the operation targeted Microsoft 365 users and was reportedly still active during the investigation. Researchers gained administrative access to the campaign’s management panel and found it had controlled 42 virtual private server nodes during its lifecycle. Most of the servers were hosted by Vultr, operated by The Constant Company LLC . The platform used an Evilginx2 phishing template, called “offy,” designed specifically to proxy Microsoft 365 authentication sessions. The panel reportedly collected 5,137 records from 3,331 unique victim IP addresses across more than 40 countries. India accounted for the largest share, followed by France, Saudi Arabia, New Zealand, and Germany. The data included 1,032 plaintext passwords, 4,148 session cookies, and 474 completed authentications where multi-factor authentication was successfully bypassed. BigBear 2.0 appears to operate as a multi-tenant service leased to affiliates. At least five operators received stolen credentials and session data through dedicated Telegram bots in real time. The operator behind the service reportedly used the alias “General Boss.” Campaign Timeline (Source: cloudsek) BigBear 2.0 Bypasses MFA Unlike ordinary credential phishing, BigBear 2.0 uses an adversary-in-the-middle proxy. Victims are sent to a phishing domain that displays a proxied version of the legitimate Microsoft sign-in page. The proxy silently relays traffic between the victim and Microsoft while recording crede

5. update from gbhackers.com

   Hackers Steal Microsoft 365 Sessions to Hijack Accounts Even After MFA

   gbhackers.com · 35d ago · September 8th, 2026

   CloudSEK’s TRIAD team uncovered the operation after gaining administrative access to its control panel in June 2026 The campaign demonstrates a critical reality for Microsoft […] The post Hackers Steal Microsoft 365 Sessions to Hijack Accounts Even After MFA appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

6. update from www.theregister.com

   BigBear phishing crew nets thousands of Microsoft 365 credentials Researchers got inside the crooks' admin panel and found 5,137 stolen reco

   www.theregister.com · 35d ago · September 8th, 2026

   BigBear phishing crew nets thousands of Microsoft 365 credentials Researchers got inside the crooks' admin panel and found 5,137 stolen reco

   via Mastodon https://www.theregister.com/security/2026/09/08/bigbear-phishing-crew-nets-thousands-of-microsoft-365-credentials/5294944

7. mentioned by www.cloudsek.com

   CloudSek, from yesterday: Tracking BigBear 2.0 Evilginx2 Phishing Campaign https://www. cloudsek.com/blog/tracking-big bear-2-0-evilginx2-ph

   www.cloudsek.com · 35d ago · September 8th, 2026

8. mentioned by insicurezzadigitale.com

   BigBear 2.0: the phishing-as-a-service platform that also bypasses Microsoft 365 MFA. CloudSEK reveals BigBear 2.0, an AiTM-based kit...

   insicurezzadigitale.com · 34d ago · September 9th, 2026