The "BigBear 2.0" Threat: How Sophisticated Phishing-as-a-Service is Bypassing MFA at Scale

September 8, 2026 5 Min Read

The cybersecurity landscape has shifted dramatically, moving away from simple credential theft toward the sophisticated hijacking of authenticated sessions. A recent investigation by the cybersecurity firm CloudSEK has uncovered a sprawling "phishing-as-a-service" (PhaaS) operation dubbed BigBear 2.0. This campaign, which targeted 461 organizations across more than 40 countries, demonstrates how modern threat actors are commodifying advanced techniques to bypass traditional multifactor authentication (MFA) and infiltrate Microsoft 365 environments with alarming ease.

With 4,148 captured session cookies and 1,032 plaintext passwords unearthed from a single administrative panel, BigBear 2.0 serves as a stark reminder that the traditional "password + MFA" defense model is no longer sufficient against adversaries who have evolved to exploit the underlying mechanics of web authentication.

Main Facts: The Anatomy of BigBear 2.0

The BigBear 2.0 operation is not merely a collection of isolated attacks; it is a professionalized, multi-user service that lowers the barrier to entry for cybercriminals. By leveraging the Evilginx2 framework, the operators have successfully industrialized "Adversary-in-the-Middle" (AiTM) phishing.

Unlike traditional phishing sites that simply log a username and password, an Evilginx2-powered site acts as a transparent reverse proxy. When a victim navigates to a malicious link, they are presented with a site that mirrors the legitimate Microsoft 365 login portal. As the user enters their credentials and completes their MFA challenge, the proxy intercepts the traffic in real-time. Crucially, once the authentication is successful, Microsoft issues an authenticated session cookie. BigBear 2.0 captures this cookie, effectively granting the attacker a "golden ticket" to access the user’s account without ever needing to perform the MFA process themselves.

CloudSEK’s researchers gained rare access to the operation’s administrative dashboard in June, revealing a treasure trove of data:

Total Credential Records: 5,137 entries.
Targeted Organizations: 461 distinct entities across 40+ countries.
Session Hijacks: 474 records confirmed successful account takeovers where attackers utilized the intercepted session cookies.
Technical Sophistication: The platform utilizes residential proxies that dynamically match the victim’s geographic location, effectively bypassing common Conditional Access policies that rely on IP-based or location-based integrity checks.

Chronology: Unmasking the Operation

The discovery of BigBear 2.0 was the result of proactive threat intelligence gathering. CloudSEK’s visibility into the operation began in June 2024, when researchers successfully infiltrated the backend infrastructure.

Mid-2024: CloudSEK identifies the administrative panel, revealing that the infrastructure is being managed by a team of at least five affiliate operators.
June – July 2024: During this period, the researchers observed the rapid deployment and rotation of infrastructure. Specifically, 42 unique virtual private server (VPS) nodes were identified as being used to host the phishing proxies.
Late July 2024: The operators began aggressively cleaning their infrastructure, deleting at least 26 of the VPS nodes from the panel in a move likely intended to evade forensic tracking and attribution.
Current Status: While the specific panel observed by CloudSEK has been monitored and analyzed, the underlying methodology remains a persistent threat, with the "service" model ensuring that the infrastructure can be spun up or moved at a moment’s notice.

Supporting Data: A Target-Rich Environment

The data extracted from the BigBear 2.0 panel highlights a calculated selection of victims. The most frequently targeted sector, by a significant margin, is the IT services and managed service providers (MSPs) category, which accounted for 151 of the identified organizations.

This targeting strategy is highly tactical. MSPs are "force multipliers" for attackers; by compromising a single MSP administrator, an adversary can potentially gain access to the environments of hundreds of downstream clients. This supply-chain risk is a central pillar of the BigBear 2.0 business model. By focusing on users with elevated administrative privileges, the operators maximize the return on investment for their phishing campaigns.

The inclusion of custom code designed specifically to disable FIDO2/WebAuthn prompts on the phishing pages indicates that the attackers are actively trying to "downgrade" the user’s security posture, pushing them toward more easily intercepted methods like SMS or push-based notifications.

Expert Perspectives: The Shift to Session Hijacking

Industry experts agree that BigBear 2.0 represents a watershed moment in how phishing is packaged and sold.

Keith Prabhu, founder and CEO of Confidis, notes that the significance of BigBear 2.0 lies in the democratization of high-end tradecraft. "The underlying technique is not new, but BigBear 2.0 changes the equation regarding accessibility and scale," says Akshat Tyagi, associate practice leader at HFS Research. "It packages AiTM phishing, residential proxies, and automated cookie replay into a service that lowers the expertise needed to run these attacks."

Sakshi Grover, senior research manager for cybersecurity products at IDC Asia Pacific, emphasizes that the industry must reframe its understanding of authentication artifacts. "Session cookies and access tokens should be treated as high-value authentication material rather than mere technical artifacts behind the password," Grover explains. "The risk is that many enterprise controls are still geared toward detecting credential theft rather than the hijacking of an already authenticated session."

Implications: Rethinking Enterprise Security

The existence of BigBear 2.0 necessitates a fundamental shift in how organizations defend their cloud environments.

1. Moving Beyond Traditional MFA

The days of relying on SMS, OTP, or simple push-based MFA are numbered. Because these methods are vulnerable to AiTM interception, organizations must pivot toward phishing-resistant authentication. Standards such as FIDO2/WebAuthn (passkeys) and hardware-backed security keys (like YubiKeys) are now the gold standard. Unlike standard MFA, these methods provide cryptographic proof of origin, making it impossible for a reverse-proxy to intercept the authentication request.

2. The "Active Session" Crisis

Organizations must change their incident response playbooks. As Keith Prabhu warns, "Treat the event as an active session compromise, not merely a stolen-password incident."
When a session is hijacked, changing the password is insufficient because the attacker already possesses a valid, authenticated session token. Responders must:

Immediately revoke all active Entra (formerly Azure AD) sign-in sessions and refresh tokens.
Audit for malicious inbox rules, OAuth consent grants, and newly registered MFA devices.
Assume the attacker has moved laterally from the initial compromised user to other cloud applications.

3. Strengthening Conditional Access

While attackers are using residential proxies to spoof locations, organizations can still leverage Continuous Access Evaluation (CAE) and token protection policies where supported. However, as noted by experts, this is not a silver bullet; coverage varies across platforms and workloads, and attackers are constantly innovating to bypass these checks.

4. Operational Integration

Finally, the "identity gap" remains a significant hurdle. Security Operations Centers (SOCs) must integrate identity signals directly into their SIEM/XDR platforms. Often, identity-related anomalies (like a sudden change in user-agent string or a session originating from a different browser fingerprint) are siloed away from the teams responsible for threat detection. Bridging this gap is essential for catching the subtle signs of session hijacking before the attacker performs data exfiltration or deploys ransomware.

Conclusion

BigBear 2.0 is more than just a phishing campaign; it is a signal of the maturation of the cybercrime economy. By automating the capture of authenticated sessions, attackers have effectively bypassed the most common security hurdle facing modern enterprises. For organizations to survive in this landscape, they must stop viewing authentication as a single point-in-time event and start treating every session as a potentially high-value asset that requires continuous verification, robust monitoring, and, ultimately, a move toward truly phishing-resistant infrastructure.