BigBear PhaaS Bypasses Microsoft 365 MFA at 258 Organizations, Stealing 5,137 Credentials
Proactive Security for the AI Era
NodeZero continuously and autonomously pentests infrastructure, identity, cloud, and now web applications, chaining weaknesses across every domain the way real attackers do. Every finding ships with replayable proof showing exploitable business impact, not theoretical risk.
BigBear 2.0, a Microsoft 365 adversary-in-the-middle (AiTM) phishing-as-a-service platform, bypassed multi-factor authentication at 258 confirmed organizations and stole 5,137 credential records including 474 authenticated session cookies, according to a CloudSEK report published September 7, 2026. The attack reached 461 organizations in total targeting data, spanning 40 countries, making it one of the largest confirmed AiTM phishing operations disclosed in 2026.
BigBear operates on the Evilginx2 reverse-proxy framework using a custom Microsoft 365 phishlet configuration called "offy." When a victim clicks a BigBear phishing URL and enters credentials, the platform forwards every authentication request to Microsoft's real servers while transparently intercepting the response, capturing the victim's password, their MFA token, and the fully authenticated post-MFA session cookie. The attacker replays that session cookie to access the Microsoft 365 account directly, with no additional authentication challenge. Push-based MFA, SMS one-time passwords, and TOTP authenticator codes are all defeated because the proxy steals the session after authentication completes.
BigBear defeats Microsoft 365 MFA right now because most organizations still permit SMS and TOTP as authentication methods. The platform injects custom JavaScript that detects and disables FIDO2/WebAuthn browser functionality during the phishing flow, forcing victims to fall back to weaker MFA options the proxy can intercept. Any Microsoft 365 tenant that has not enforced phishing-resistant FIDO2-only authentication and eliminated SMS and TOTP fallbacks is a viable target for BigBear's five affiliate operators, who remain active and are expected to rebuild their infrastructure under new domains following CloudSEK's September 7 disclosure.
How Does BigBear AiTM Phishing Work?
BigBear 2.0 implements the Microsoft 365 AiTM phishing bypass technique using Evilginx2, an open-source reverse proxy framework designed to intercept authentication sessions. The platform runs a Microsoft 365-specific phishlet profile named "offy" that instructs the proxy to forward all traffic to Microsoft's authentication endpoints while extracting credentials and session cookies in transit.
The attack sequence starts when a victim clicks a phishing URL pointing to BigBear's proxy server. The proxy fetches the legitimate Microsoft 365 login page and serves a pixel-identical copy to the victim. Every form submission (username, password, MFA code) passes through the proxy to Microsoft's servers. Microsoft responds with a legitimate authentication session, which BigBear intercepts before forwarding it to the victim's browser. The victim lands on their real Microsoft 365 inbox having completed authentication normally, unaware that the session cookie was captured and relayed to an affiliate operator via Telegram.
BigBear incorporates one technically significant capability: custom JavaScript that detects FIDO2/WebAuthn API calls in the victim's browser and disables them before authentication begins. Hardware security keys and passkeys use the WebAuthn protocol and bind credentials to the origin domain of the authentication page. Since BigBear's proxy domain does not match Microsoft's domain, a hardware key would refuse to provide credentials, blocking the attack. BigBear's JavaScript preemptively disables this path, pushing victims toward SMS or TOTP codes that the proxy intercepts freely.
The platform's operational infrastructure includes 42 VPS nodes with geo-matched residential proxies covering 69 countries. Residential proxies present victim-country IP addresses to Microsoft's login page, preventing location-based risk signals from appearing in Entra ID sign-in logs. Stolen credentials flow to five identified affiliate operators in real time via Telegram bots, with MFA-bypassed sessions, plaintext passwords, and session cookies delivered as separate structured records.
Phishing Delivery
Victim receives a message with a BigBear proxy URL mimicking a Microsoft 365 login prompt, often spoofing SharePoint, Teams, or MFA re-enrollment notifications.
AiTM Proxy Intercept
Victim authenticates through BigBear's Evilginx2 reverse proxy. Custom JavaScript disables FIDO2/WebAuthn, forcing SMS or TOTP MFA that the proxy intercepts mid-flight.
Session Cookie Theft
BigBear captures the authenticated post-MFA session cookie and forwards it to affiliate operators via Telegram bot in real time, while the victim reaches their real Microsoft 365 inbox.
Account Takeover
Affiliates replay the stolen session cookie from a separate device, gaining full authenticated access to the Microsoft 365 account without any MFA challenge.
Persistence and Lateral Movement
Attackers establish persistence via inbox forwarding rules, OAuth app grants, registered devices, or Teams access, then pivot to internal systems or downstream organizations.
BigBear Campaign Scope: 258 Organizations and 40 Countries
CloudSEK obtained access to BigBear 2.0's administrator panel, providing direct visibility into the platform's victim data and operational infrastructure. The confirmed victim set spans 258 distinct organizations with at least one successful MFA-bypass compromise. The broader targeting dataset shows 461 organizations, indicating that some targeted users did not complete the phishing flow or were blocked by security controls before credential capture.
The 5,137 total credential records break down into three categories with different risk profiles. The 474 fully MFA-bypassed authentication records are the highest-severity entries: each represents a session cookie that, at the time of capture, granted immediate authenticated access to a Microsoft 365 account. Session cookies have configurable lifetimes and may remain valid in organizations that have not revoked sessions since the compromise window. The 1,032 plaintext passwords are usable for credential stuffing against any other service where the victim reuses the password. The 4,148 session cookies include authenticated sessions from varying points in the browsing session with potentially shorter validity windows.
The campaign's geographic spread is broad. BigBear's 3,331 unique victim IP addresses span more than 40 countries, with concentration in the United States, United Kingdom, Germany, Australia, and Canada. The use of geo-matched residential proxies means Entra ID sign-in logs for affected accounts likely show no unfamiliar location risk signals during the compromise. Organizations relying solely on Conditional Access location policies without device compliance requirements face a specific detection gap for this campaign pattern.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
BigBear PhaaS Operations: Affiliate Infrastructure and Telegram Delivery
BigBear 2.0 operates as a multi-tenant platform where affiliate operators lease access and run independent phishing campaigns under a shared infrastructure umbrella. CloudSEK identified five distinct affiliate operators in the recovered admin panel data, each receiving stolen credentials via Telegram bots that push structured records immediately as victims complete the phishing flow.
The platform's operational security posture is sophisticated relative to commodity phishing kits. The 42 VPS nodes distribute traffic across multiple hosting providers to prevent single-point takedowns. Residential proxy routing through 69 countries provides both geographic flexibility for operators and a specific defensive bypass: enterprise Conditional Access policies enforcing country-based allow lists typically do not flag sign-ins from residential IP addresses as high risk, since these appear as end-user connections rather than datacenter traffic.
BigBear's phishing infrastructure went offline approximately three weeks before the September 7, 2026 CloudSEK publication, likely following notification to hosting providers after CloudSEK obtained admin panel access. The five affiliate operators remain active and are expected to deploy under new infrastructure. The attack technique and phishlet configuration remain viable as long as target organizations permit SMS or TOTP MFA fallback.
“BigBear uses custom JavaScript that interferes with FIDO2/WebAuthn authentication, disabling the browser functionality that accommodates it to push targets toward weaker methods.”
CloudSEK Threat Intelligence, September 7, 2026
Indicators of Compromise
BigBear's phishing infrastructure went offline approximately three weeks before disclosure, limiting the immediate blocking value of specific domain names and IP addresses. Defenders should focus on behavioral indicators detectable in Entra ID sign-in logs and Microsoft 365 Unified Audit Log data.
Deploy the following behavioral and structural indicators to your SIEM and Entra ID Workbook environment to identify existing session compromise and detect future AiTM phishing activity against your Microsoft 365 tenant.
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Sigma Detection Rules for BigBear AiTM Phishing
No CVE-specific community Sigma rule exists for BigBear 2.0. It is a phishing service, not a CVE-based exploit. The following rules were generated by Decryption Digest from BigBear's confirmed attack behavior. Both carry status: experimental and should be validated against your tenant's baseline sign-in volume before production deployment.
Rule 1 targets Microsoft Entra ID sign-in logs and detects the session replay pattern that defines AiTM compromise. Rule 2 targets the Microsoft 365 Unified Audit Log and catches the inbox forwarding persistence tactic used after successful account takeover. Deploy Rule 1 via Microsoft Sentinel's Analytics rules or your Entra ID Workbook, and Rule 2 via the OfficeActivity table in Sentinel or your Microsoft 365 SIEM integration.
Subscribe to unlock Sigma Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Subscribe to unlock Sigma Hunt Queries
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Subscribe to unlock WAF Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Remediation: Enforce Phishing-Resistant MFA and Revoke Sessions
Organizations using Microsoft 365 must address BigBear and AiTM phishing through immediate session hygiene for potentially affected accounts combined with structural enforcement of phishing-resistant authentication. The steps below are ordered by urgency.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Why Microsoft 365 AiTM Phishing Bypass Matters for Your Organization
AiTM phishing represents the definitive defeat of push-based MFA. Security teams that completed MFA deployment believe they have closed the credential theft attack path. BigBear's campaign shows that belief is incorrect for any organization permitting SMS, TOTP, or push-notification MFA. The 258 confirmed compromised organizations in CloudSEK's data set each had MFA deployed. MFA deployment is not MFA security.
The five BigBear affiliates remain active and will rebuild their infrastructure under new domains and VPS nodes. The underlying Evilginx2 framework is open source, the "offy" Microsoft 365 phishlet configuration is publicly documented, and the residential proxy services that defeat location-based controls are commercially available at low cost. BigBear's takedown creates a window of days before equivalent capability re-emerges under a new name.
Microsoft 365 session cookies from BigBear's 4,148 captured tokens may remain valid in organizations that have not revoked sessions since the compromise window (approximately July to mid-August 2026). An attacker holding a valid session cookie with an active refresh token can access SharePoint, Teams, Exchange, OneDrive, and any connected Azure application without triggering authentication. The risk from existing stolen sessions is distinct from preventing future BigBear campaigns, and is the higher priority action.
The FIDO2 enforcement Conditional Access policy in the remediation steps above deploys in under one hour and closes the AiTM attack path completely for users on compliant hardware. It is the single most effective action available today to eliminate BigBear-class phishing risk from your Microsoft 365 tenant.
For additional Microsoft 365 security context, see our Citrix NetScaler CVE-2026-19490 analysis on lateral movement patterns after initial access, and our N-central CVE-2026-86218 coverage on how MSP-scale credential theft often follows enterprise phishing campaigns.
The bottom line
Microsoft 365 AiTM phishing bypass confirmed at 258 organizations: BigBear 2.0 stole 5,137 credentials including 474 fully authenticated session tokens that may still grant live account access. Three actions define the response: (1) revoke all Microsoft 365 sessions organization-wide now, (2) enforce FIDO2-only Conditional Access to permanently block AiTM proxies, and (3) audit every account for inbox forwarding rules and OAuth grants created in the past 30 days. Deploy the phishing-resistant MFA Conditional Access policy before end of business today.
This analysis is generic. create a free account to score threats like this against your own stack.
Frequently asked questions
What is an adversary-in-the-middle (AiTM) phishing attack?
An adversary-in-the-middle (AiTM) phishing attack deploys a reverse proxy server between the victim and the legitimate authentication service. When the victim visits a phishing URL and enters credentials, the proxy forwards every request to the real login page and relays responses back to the victim. The attacker intercepts both the password and the MFA token in real time, then replays the captured session cookie to access the account without triggering further authentication challenges. Standard push-based MFA, SMS OTP, and TOTP codes are all defeated because the proxy steals the session after MFA completes, not before.
What is BigBear 2.0 and how does it work?
BigBear 2.0 is a phishing-as-a-service platform built on the Evilginx2 AiTM framework. Operators lease access to the platform and receive a multi-user admin panel for managing campaigns. BigBear uses a phishlet configuration called 'offy' to proxy Microsoft 365 authentication, intercepting credentials and session tokens as users log in. Custom JavaScript injected into the phishing page detects and disables FIDO2/WebAuthn browser functionality, forcing victims toward weaker MFA methods (SMS, TOTP) that the proxy can intercept. Captured credentials are delivered to affiliate operators in real time via Telegram bots. The platform managed 42 VPS nodes with residential proxies across 69 countries to evade geo-fencing Conditional Access controls.
Does BigBear defeat hardware security keys and passkeys?
Hardware FIDO2 security keys (YubiKey, Google Titan) and passkeys with proper origin binding are resistant to BigBear's AiTM proxy. When a victim is on the BigBear proxy domain, the phishing page's origin does not match the key's registered domain, so the WebAuthn ceremony fails without providing any credential data to the attacker. BigBear counters this by injecting JavaScript that disables FIDO2/WebAuthn in the victim's browser, pushing them to fall back to SMS or TOTP. Organizations that have removed SMS and TOTP as fallback options and enforce FIDO2-only authentication block BigBear's attack path entirely.
Which organizations and sectors were targeted by BigBear?
CloudSEK identified 258 confirmed compromised organizations and 461 organizations in broader targeting data spanning 40 or more countries. The campaign shows no sector-specific targeting pattern: victims include organizations across technology, finance, healthcare, education, and government verticals. Any organization using Microsoft 365 with push-based MFA, SMS OTP, or TOTP codes is a viable target. The 3,331 unique victim IP addresses indicate a geographically broad, opportunistic campaign rather than precision targeting.
How do I detect if my organization was affected by BigBear?
Review Microsoft Entra ID sign-in logs for authentication events where the IP address used for MFA completion differs from the IP address used for subsequent activity. Look for session tokens originating from residential proxy ranges immediately following successful MFA. Hunt for Entra ID sign-ins with unfamiliar sign-in properties or token issuer anomaly risk detections. Suspicious AiTM activity in Microsoft 365 appears as successful sign-ins from expected user locations followed immediately by access from unexpected geographic locations using the same session token. The Sigma and hunt queries in this post provide ready-to-deploy detection logic for Microsoft Sentinel, Splunk, Elastic, and seven other platforms.
What is the difference between BigBear and standard phishing kits?
Standard phishing kits capture credentials from a static form and are blocked by MFA because the attacker cannot complete the second factor. BigBear operates as a live reverse proxy, forwarding every HTTP request and response in real time between the victim and Microsoft's authentication servers. This defeats MFA because the full authentication session, including the post-MFA session cookie, passes through the attacker's server before reaching the victim's browser. The attacker captures the authenticated session cookie, which grants account access without any further authentication requirement.
What is the remediation timeline for BigBear-compromised accounts?
Compromised accounts require immediate remediation. Revoke all active sessions using Microsoft Entra ID's Revoke Sessions function for affected users. Reset passwords for any account where credentials were captured. Force re-authentication across all devices. For accounts where MFA-bypassed session tokens were stolen, session revocation alone is insufficient if the attacker has already created persistence through forwarding rules, OAuth grants, or registered devices. Audit each affected account for inbox rules, OAuth app grants, and registered authentication methods before re-enabling access.
Will disabling SMS and TOTP MFA stop BigBear attacks?
Removing SMS and TOTP as MFA options is necessary but not sufficient on its own. BigBear injects JavaScript to disable FIDO2/WebAuthn in the victim's browser, then relies on the victim falling back to SMS or TOTP. If no fallback exists, authentication fails and no credentials are captured. However, organizations must also ensure that Conditional Access policies block authentication fallback and that no SMS or TOTP enrollment path exists as an exception for any user group. The complete protection requires enforcing FIDO2-only authentication with no SMS or TOTP fallback path for any user.
Sources & references
- CloudSEK: BigBear 2.0 Microsoft 365 AiTM Phishing-as-a-Service Analysis
- BleepingComputer: BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
- MITRE ATT&CK: T1557, Adversary-in-the-Middle
- CISA: Implementing Phishing-Resistant MFA
- Microsoft: Require phishing-resistant MFA for administrators
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.