www.it-connect.fr
Microsoft 365 Phishing: BigBear 2.0 Bypassed MFA at 258 Organizations
BigBear 2.0 is the name of a phishing-as-a-service platform that intercepted more than 5,000 credentials and enabled the compromise of Microsoft 365 accounts belonging to 258 organizations. And France ranks among the most affected countries. Here’s what we know about this threat.
A new report published by CloudSEK discusses the BigBear 2.0 phishing kit, a commercial offshoot of Evilginx2, an open source framework. As part of their research, the investigators managed to gain administrator access to the control panel, giving them a complete view of the infrastructure, affiliates, and stolen data. And suffice it to say, the operation is running at full speed.
Before getting into this campaign, let’s talk about the technique itself. This is an adversary-in-the-middle (AiTM) attack. The victim clicks a phishing link and lands on a page that relays the real Microsoft login portal in real time. They enter their email address, password, and approve MFA via push notification, TOTP code, or SMS... and everything passes through the attacker’s proxy.
The value for the attacker is clear: capture the valid session cookie issued by Microsoft before it even reaches the victim’s browser. In other words, it gives the attacker a direct route in: they simply replay the cookie and bypass MFA in the process. The technique is well known, and I have already covered it, for example in my article on VoidProxy, this phishing platform that steals Microsoft 365 and Google accounts despite MFA. BigBear 2.0 follows the same pattern.
An industrialized operation, with France in second place
The admin panel associated with the BigBear 2.0 service manages 42 VPS servers, all hosted at Vultr, and dedicated exclusively to Microsoft 365. The operator rents the platform to at least five affiliates, each receiving stolen credentials in real time through their own Telegram bot.
And the haul is significant: "The panel exfiltrated 5,137 credential records, including 474 complete authentications with MFA bypass, 1,032 cleartext passwords, and 4,148 session cookies, affecting 3,331 unique victim IP addresses across more than 40 countries, with the operation still active at the time of writing," CloudSEK writes. It is said to involve 258 confirmed Microsoft account compromises.
Where are the targets located? According to the same report, India tops the list with 658 records (12.8% of the total), followed by France with 463 records (9%), then Saudi Arabia. By industry, IT service providers and MSPs appear to be the most targeted, with 151 organizations (even though the largest share of the chart falls into the unknown category). A logical choice to maximize impact: compromise a managed service provider, and you may potentially open the door to dozens of clients.
Three JavaScript injections to neutralize your defenses
What sets BigBear 2.0 apart from standard Evilginx2 is the addition of three scripts injected into each relayed login page:
- FIDO2/WebAuthn disabled. The script redefines the browser’s PublicKeyCredential object to make it unavailable. As a result, users with a security key or passkey are pushed toward a weaker method (SMS, OTP code), which is vulnerable to interception.
- Microsoft telemetry blocked. Requests to events.data.microsoft.com, OneCollector, and canary tokens are silently removed, preventing Microsoft from detecting the fraudulent page.
- "Stay signed in" automatically checked. The script checks the option and clicks the validation button after 800 milliseconds, in order to maximize the lifespan of the stolen cookie.
On top of that, there is a residential proxy pool covering 69 countries. When a French victim logs in, traffic to Microsoft exits through a French residential IP. Alerts about sign-ins from an unusual country and conditional access policies based on location are fooled. BigBear 2.0 is also designed to block visitors coming from a datacenter or a VPN, making the job harder for researchers and sandboxes. Finally, a keepalive function refreshes captured sessions using the refresh token, which is valid for up to 90 days with Microsoft: a way to exploit them later.
To protect against this threat, CloudSEK also provides a series of recommendations. If an account has been exposed, it is essential to reset the password and, above all, revoke the sessions. In practical terms, the only method that structurally resists AiTM is FIDO2/WebAuthn. On that note, Windows Hello for Business is part of it, and I have also published a complete guide to deploying it with Intune. It is also better to condition access on a managed device rather than on geolocation (conditional access policy).
That said, as mentioned earlier, BigBear 2.0 injects a script designed to sabotage the use of FIDO2 and push the user toward a weaker method. The fallback should therefore be blocked, at least for sensitive accounts, at the authentication policy level.
