BigBear 2.0

BigBear 2.0, an Evilginx2-based Microsoft 365 phishing-as-a-service panel that JavaScript-disables FIDO2/WebAuthn to force victims onto phishable MFA, leased to at least five affiliates

CloudSEK's TRIAD team gained administrator access to the control panel of BigBear 2.0, a rebranded, Evilginx2-based adversary-in-the-middle phishing-as-a-service operation targeting Microsoft 365 exclusively, and published full technical findings on 2026-09-07 (CloudSEK, 2026-09-07). Victims reach the operation by clicking a phishing link typically delivered via email, which proxies them to what appears to be the legitimate Microsoft login page (CloudSEK, 2026-09-07). The panel managed 42 VPS nodes running Evilginx2's reverse-proxy engine on a single phishlet that proxies the entire authentication flow between the victim and Microsoft's own login domain: the victim's password is captured in plaintext as it passes through, and after the victim completes MFA, Microsoft's own session cookie is captured off the wire before it reaches the victim's browser, because the proxy terminates the victim's TLS session before opening its own to Microsoft (CloudSEK, 2026-09-07). That cookie is bound to the browser session but not to any device or location, so importing it into an attacker-controlled browser inherits the fully authenticated session, TOTP, push and SMS MFA are all structurally bypassed this way, since the proxy never has to defeat the second factor, only wait for the legitimate user to clear it (CloudSEK, 2026-09-07; BleepingComputer, 2026-09-07).

What distinguishes this operation from stock Evilginx2 deployments is custom JavaScript injected into every proxied login page that monkey-patches the browser's PublicKeyCredential/navigator.credentials API, forcing a fallback away from FIDO2/WebAuthn, the one MFA class immune to AiTM replay, because its cryptographic assertion is bound to the legitimate origin domain and fails outright when the browser's actual origin is the phishing domain rather than Microsoft's own (CloudSEK, 2026-09-07). The same injected code blocks outbound requests to Microsoft's own anti-phishing telemetry and canary-token endpoints and auto-enables "Keep me signed in" to maximize the stolen session's lifetime (CloudSEK, 2026-09-07). The panel exposes a REST API that automatically replays captured cookies against Microsoft 365, and a keepalive feature abuses captured refresh tokens (typically valid around 90 days on a sliding window) to periodically refresh session cookies well past their nominal expiry (CloudSEK, 2026-09-07). A geo-matched residential-proxy pool spanning 69 countries routes relayed traffic through an IP in the victim's own country, defeating Microsoft's location-anomaly detection and satisfying IP-based Conditional Access checks that key on geolocation rather than device state (CloudSEK, 2026-09-07).

At the time of CloudSEK's writing the panel had captured 5,137 credential records (474 complete MFA-bypassed sessions, 1,032 plaintext passwords, and 4,148 session cookies) from 3,331 unique victim IPs across more than 40 countries (CloudSEK, 2026-09-07). BleepingComputer's own review of CloudSEK's dataset gives the organizational scale directly: 258 distinct organizations had at least one completed MFA-bypass compromise, out of 461 organizations that appear in the broader targeting dataset (BleepingComputer, 2026-09-07). CloudSEK describes the operation as still active as of its report, but also records that the threat actor has deleted 26 of the panel's 42 observed VPS nodes since late July 2026 as apparent counter-forensic activity following detection (CloudSEK, 2026-09-07); BleepingComputer separately reports that, as of its own writing, BigBear's administration panel remains reachable while the phishing infrastructure itself has been offline for nearly three weeks (BleepingComputer, 2026-09-07), consistent with an operator tearing down active phishing nodes under pressure while the panel and its captured-credential dataset persist. The service is leased to at least five identified affiliate operators, each receiving stolen credentials in real time through dedicated Telegram bots (CloudSEK, 2026-09-07; BleepingComputer, 2026-09-07). IT-services and managed-service-provider organizations were the single largest targeted sector, which CloudSEK notes is disproportionate because a compromised IT provider's privileged access to client Azure AD, on-premises AD, RMM tooling and password managers enables downstream supply-chain compromise of its customers (CloudSEK, 2026-09-07).

Triage: the vendor-neutral tell is a session-cookie-authenticated action with no matching interactive MFA challenge in the same session lineage, or a token-issuance event immediately followed by activity from a network location or device-compliance state inconsistent with the device that originally enrolled; a legitimate user re-using a cached session from a known device does not produce this mismatch, which is what separates the AiTM replay from ordinary session persistence.