BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
-
A phishing-as-a-service (PhaaS) operation tracked as BigBear 2.0 has been observed compromising Microsoft 365 environments at scale. According to telemetry, the campaign successfully bypassed multi-factor authentication (MFA) and harvested over 5,000 credentials across 258 organizations.
The attack methodology relies on adversary-in-the-middle (AiTM) techniques to intercept session tokens. Below is a concise overview of the operational details and indicators.
- Target scope: 258 unique organizations; more than 5,000 Microsoft 365 accounts compromised.
- Primary tactic: AiTM phishing to steal session cookies, allowing attackers to bypass MFA requirements.
- Payload focus: Microsoft 365 login pages, often using lookalike domains and urgency-based lures.
- Post-exploitation: Stolen sessions are typically used for data exfiltration and follow-up business email compromise (BEC).
Practical mitigation steps
- Enforce conditional access policies that require device compliance or trusted locations, not just a one-time password.
- Review sign-in logs for anomalous session activity, particularly where MFA was satisfied but geolocation or IP reputation appears suspicious.
- Implement phishing-resistant MFA, such as FIDO2 security keys, where feasible.
- Monitor for newly registered domains that mimic your organisation’s login portal.
Given the low cost of entry for such PhaaS platforms, it is likely this pattern will continue to evolve. Organisations relying solely on OTP-based MFA should treat these campaigns as a direct threat to their identity perimeter.
Source: Unknown
Has your team reviewed sign-in logs for unusual session behaviour, or have you already moved to phishing-resistant MFA?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login