BigBear 2.0 Phishing Campaign Targets Microsoft 365 Users

• •BigBear 2.0 has exfiltrated over 5,137 Microsoft 365 credentials using Evilginx2.
• •The campaign employs a man-in-the-middle technique to hijack sessions post-MFA.
• •At least 258 organizations have been compromised, with significant impacts across 40+ countries.

The BigBear 2.0 phishing-as-a-service campaign has compromised over 5,137 Microsoft 365 credentials from 258 organizations, utilizing an Evilginx2-based framework to bypass multi-factor authentication (MFA). Discovered by CloudSEK in June 2026, the operation employs a man-in-the-middle technique to intercept session cookies after MFA completion, allowing attackers to hijack authenticated sessions. The campaign has affected 3,331 unique victim IPs across more than 40 countries, with significant targeting in India, France, Saudi Arabia, New Zealand, and Germany. The infrastructure includes 42 VPS nodes, with 26 deleted to evade detection. The operation remains active, with at least five affiliate operators receiving stolen credentials in real-time via Telegram. Organizations are advised to reset compromised passwords and strengthen their authentication methods.