Phishing kit 'BigBear' walked past Microsoft 365 logins at 258 companies

Key points

• A rented phishing service called BigBear 2.0 broke into Microsoft 365 accounts at 258 organisations, according to researchers at CloudSEK.
• The panel had captured 5,137 credential records, including 474 logins where two-factor checks were fully bypassed, 1,032 plain-text passwords and 4,148 session cookies.
• Victims were spread across more than 40 countries and 3,331 unique IP addresses.
• Five or more criminal customers receive stolen logins in real time through Telegram bots.
• The phishing sites have been offline for about three weeks, though the operators' control panel remains live.

A phishing operation called BigBear 2.0 has been quietly siphoning Microsoft 365 logins from hundreds of companies, and researchers say the kit is good enough to walk straight past two-factor security checks.

CloudSEK, the security firm that dug into it, managed to get administrator access to the crooks' own control panel. What they found inside was an industrial little business.

What is BigBear and how does it work?

BigBear is phishing-as-a-service: a ready-made phishing kit that criminals rent, the way a small business might rent accounting software. The operators handle the fake login pages and the plumbing. Their customers just log in and collect stolen accounts.

The kit uses a technique called adversary-in-the-middle, where the fake login page acts as a silent relay between the victim and the real Microsoft sign-in. You type your password; it goes to Microsoft. Microsoft asks for your two-factor code; you type that too. Everything appears to work fine.

The criminals were sitting in the middle the whole time, copying your password and the small file called a session cookie that Microsoft hands your browser to prove you have already signed in. Steal that cookie, replay it from another computer, and you are logged in as the victim without needing the password or the code again.

BigBear is built on an open-source tool called Evilginx2, which security testers use legitimately and criminals use less legitimately. We first covered Evilginx2-based attacks on 25 August 2026, when Mirage2FA was harvesting credentials across US and European companies. CloudSEK counted 42 rented servers wired up to run the BigBear attack, all pointed at Microsoft 365.

How bad is the damage?

Bad, but bounded. CloudSEK told BleepingComputer the panel held 5,137 stolen credential records, of which 474 were complete two-factor bypasses. The rest were passwords and session cookies that remain useful to attackers.

Victims turned up in more than 40 countries. While 461 organisations appeared somewhere in the targeting data, 258 had at least one confirmed break-in.

The operators also rented residential internet connections across 69 countries so their logins to Microsoft would appear to come from the same city as the victim, defeating one of Microsoft's simplest fraud checks.

One nasty touch: the kit runs custom JavaScript that switches off support for FIDO2 and WebAuthn, the strong hardware-key logins this kind of attack cannot beat. With that route blocked, victims fall back to weaker codes the kit can steal.

Should ordinary Microsoft 365 users worry?

If your company uses Microsoft 365 and IT hasn't flagged anything, you don't need to panic. If you clicked a Microsoft login link from an unexpected email in the last few months, tell your IT team. They can check whether your account shows up in the exposed data.

For administrators, CloudSEK's advice is direct: reset any passwords that may have leaked, revoke active sessions and refresh tokens, force everyone with high-level access to sign in again, and move to hardware security keys where possible. Conditional Access policies that require company-managed devices are more reliable than location-based rules, because BigBear can spoof the location.

This is the third Microsoft 365 adversary-in-the-middle phishing kit Threat Vectr has reported since late July. None of them was stopped by code-based two-factor alone. The pattern is clear enough that hardware keys deserve to be a policy requirement, not a recommendation.

Common questions

Does two-factor authentication still help?

Yes, for almost every other kind of attack. BigBear is designed specifically to defeat code-based two-factor. Hardware security keys using FIDO2 or WebAuthn are not fooled by this technique.

How would I know if my account was hit?

Watch for sign-in alerts from countries you don't visit, sent items you didn't send, or inbox rules you didn't create that quietly forward or delete messages. Report anything odd to your IT team quickly.