BigBear phishing crew nets thousands of Microsoft 365 credentials

Researchers got inside the crooks' admin panel and found 5,137 stolen records tied to 461 organizations

ASCII smuggling isn't just an AI security risk 3 days ago

ASCII smuggling isn't just an AI security risk

My Word. Microsoft's prepping Similarity Checker for retirement 4 days ago

My Word. Microsoft's prepping Similarity Checker for retirement

Microsoft to bounce mail from outdated Exchange servers 4 days ago

Microsoft to bounce mail from outdated Exchange servers

Windows 11 update sends some desktops into an unwanted goth phase 5 days ago

Windows 11 update sends some desktops into an unwanted goth phase

Which came first, Windows 95's taskbar or 's Dock? Neither 5 days ago

Which came first, Windows 95's taskbar or 's Dock? Neither

A Microsoft 365 phishing operation targeting hundreds of organizations captured thousands of passwords and session cookies, including hundreds of authenticated sessions that could be hijacked to bypass MFA, according to researchers who accessed the crooks' own admin panel.

Security researchers at CloudSEK say they accessed the admin panel behind BigBear 2.0, an Evilginx2-based phishing-as-a-service operation targeting Microsoft 365 users, giving them an unusually detailed look at the campaign and its haul.

According to the researchers, the panel contained 5,137 records associated with 461 organizations, including 1,032 plaintext passwords and 4,148 session cookies. CloudSEK classified 474 records as complete MFA-bypassed authentications in which the attackers captured an authenticated Microsoft 365 session.

That potentially hands the crooks much more than an inbox. A hijacked Microsoft 365 account can expose email, calendars, Teams conversations, and files stored in SharePoint and OneDrive. Depending on the account's permissions, CloudSEK says it could also provide a route into Entra ID, cloud infrastructure, and federated SaaS applications – useful territory for business email compromise, internal phishing, data theft, and lateral movement.

And this isn't a postmortem. CloudSEK said the BigBear operation was still active at the time of its investigation, with its default phishing template, dubbed "offy," configured specifically to intercept Microsoft 365 authentication.

BigBear doesn't need to defeat Microsoft's MFA directly. Instead, its Evilginx2 infrastructure operates as an adversary-in-the-middle proxy between the victim and Microsoft's real login service.

Victims arriving at one of the phishing sites see Microsoft's login flow proxied through the attacker's server. Their usernames and passwords are passed to Microsoft, along with whatever MFA challenges follow. Once the victim successfully authenticates, Microsoft returns a session cookie – which passes through the attacker's infrastructure on its way back.

Security researcher Gagan Aggarwal said BigBear's customizations go further than stock Evilginx2. Researchers found JavaScript designed to disable FIDO2/WebAuthn authentication on the phishing page, pushing users toward methods such as SMS codes, push notifications, and TOTP, which remain susceptible to this kind of proxy attack.

The operation also uses a residential proxy pool covering 69 countries. If a victim is in India, for example, BigBear can route the upstream Microsoft login through an Indian residential IP, making the authentication appear less geographically suspicious. Another check attempts to block visitors arriving from datacenter, VPN, and proxy addresses, making life harder for automated scanners and researchers.

CloudSEK says the infrastructure was managed through a multi-user panel and leased to at least five affiliate operators, with stolen credentials delivered in real time via separate Telegram bots. The researchers observed 42 VPS nodes over the campaign's lifetime. Twenty-six had been deleted from the panel since late July, and just one was active when CloudSEK examined it.

Aggarwal says the person running BigBear goes by "General Boss." CloudSEK hasn't linked the operation to any known state-backed group and believes money is the motive. The stolen Microsoft 365 access could be used for business email compromise and data theft, or simply sold on to other criminals.

CloudSEK recommends phishing-resistant FIDO2/WebAuthn authentication, conditional access policies, compliant device requirements, and the revocation of compromised session and refresh tokens. ®

Boston Scientific left nursing its bottom line after cyberattack

Medical device giant warns August intrusion will hit Q3 and full-year sales and earnings as recovery drags on

ASML and TSMC want bigger masks for smaller chips

Industry push aims to eliminate stitching constraints and ready high-NA EUV systems for production by 2033

HPE makes its “unified storage” claim real as B10000 R6 hits GA

PARTNER CONTENT: Pairs block and adjacent file workloads with independent scaling of performance and capacity

How to secure hybrid meeting rooms without sacrificing user experience

FEATURE: With regulators tightening rules and attack surfaces widening, meeting-room kit must bake in security without pushing users toward workarounds

OpenAI's rebel agent swarm died young, but its chilling logs live on

'The Collective' learned to communicate, organize, cheat, and apparently sacrifice its own

LG accused of 'egregious invasion of privacy' over TV data collection

Claims follow scrutiny over monitors installing adware without user consent

virtualization Broadcom pledges to lock down open source Python, Java libraries

Broadcom pledges to lock down open source Python, Java libraries

SECURITY Terminated employee cost company hundreds of thousands of dollars because nobody revoked access

Terminated employee cost company hundreds of thousands of dollars because nobody revoked access

PERSONAL TECH Smartphone makers don't bother to comply with EU repairability requirements

Smartphone makers don't bother to comply with EU repairability requirements

virtualization VMware swings its focus back to low-end server virt, promises vSphere Standard upgrade

VMware swings its focus back to low-end server virt, promises vSphere Standard upgrade

OFF-PREM Google engineer unplugged every fiber they could see and – surprise! – took down a chunk of the G-Cloud

Google engineer unplugged every fiber they could see and – surprise! – took down a chunk of the G-Cloud

OS PLATFORM Windows 11 update sends some desktops into an unwanted goth phase

Windows 11 update sends some desktops into an unwanted goth phase

On-PREM AMD's Threadripper Halo is a local-AI workstation for researchers with deep pockets AI workstation promises to put up to 576 GB of HBM3e and 16 TB/s of memory bandwidth on your desk

AMD's Threadripper Halo is a local-AI workstation for researchers with deep pockets

AI workstation promises to put up to 576 GB of HBM3e and 16 TB/s of memory bandwidth on your desk

ai and ml Hugging Face is too important to fall into Nvidia's hands $12.9 billion deal will inevitably cement Nvidia's market dominance and harm competition in the process. Regulators should take note

Hugging Face is too important to fall into Nvidia's hands

$12.9 billion deal will inevitably cement Nvidia's market dominance and harm competition in the process. Regulators should take note

ai and ml Zuck's Muse to Spark joy with open weights release 'soon' While you wait, Meta says it’s taught the model to stop wasting tokens and ask for help a bit more often

Zuck's Muse to Spark joy with open weights release 'soon'

While you wait, Meta says it’s taught the model to stop wasting tokens and ask for help a bit more often

ai and ml With Gemini 3.8 Flash, Google reminds everyone it's still in the race AI model scores well, runs fast, and doesn't cost too much (yet)

With Gemini 3.8 Flash, Google reminds everyone it's still in the race

AI model scores well, runs fast, and doesn't cost too much (yet)

security AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit Adding insult to injury

AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit

Adding insult to injury

Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Russians are posing as Signal support to launch phishing attacks

PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Black Hat and DEF CON

DEF CON Franklin project enlists hackers to harden critical infrastructure

Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Security EQT buys majority in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

EQT buys majority in Swiss cybersecurity biz Acronis

Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

On the plus side, infosec's a good bet for a long, stable career

Feel peak Windows was 7? You might like Kumander Linux Debian and Xfce – solid, sensible choices – with a pretty skin

Feel peak Windows was 7? You might like Kumander Linux

Debian and Xfce – solid, sensible choices – with a pretty skin

Canonical shuttering some of its legacy chat channels The Ubuntu Pastebin went in June, IRC gets demoted

Canonical shuttering some of its legacy chat channels

The Ubuntu Pastebin went in June, IRC gets demoted

Audacity audio-editing app no longer looks like it's from the early 2000s The FOSS tool for audio editing has a fresh coat of paint, and new features to boot

Audacity audio-editing app no longer looks like it's from the early 2000s

The FOSS tool for audio editing has a fresh coat of paint, and new features to boot

Haiku OS rises / Beta 6 sails open web / Virtual winds fly fast A real alternative to running some kind of FOSS Unix clone

Haiku OS rises / Beta 6 sails open web / Virtual winds fly fast

A real alternative to running some kind of FOSS Unix clone

Offshoots of cancelled TrueNAS Core upgrade to FreeBSD 15 Exeunt zVault stage right; enter FreeCORE and BSDnas

Offshoots of cancelled TrueNAS Core upgrade to FreeBSD 15

Exeunt zVault stage right; enter FreeCORE and BSDnas

Debian votes to let contributors code with AI Disclosure optional, quality mandatory

Debian votes to let contributors code with AI

Disclosure optional, quality mandatory