A phishing-as-a-service (PhaaS) platform called BigBear 2.0 MFA bypass has compromised 258 organisations and exfiltrated more than 5,000 Microsoft 365 credentials, according to researchers at cybersecurity company CloudSEK. The operation was discovered in June 2026 after CloudSEK gained access to the platform’s administrative control panel, according to eSecurityPlanet.
How the BigBear 2.0 MFA Bypass Works
At its core, BigBear 2.0 uses an Evilginx2-based adversary-in-the-middle framework to sit between victims and Microsoft’s legitimate authentication infrastructure. The configuration, which BigBear calls ‘offy’, sets up a proxy that intercepts credentials and authenticated session cookies in real time, including at the point where multi-factor authentication (MFA) completes. Those cookies are then replayed through an API to hijack the victim’s active session, meaning that completing MFA offers no protection once the proxy is in play.
To sharpen that technique further, the platform deploys custom JavaScript that interferes with FIDO2/WebAuthn authentication, effectively disabling browser functionality that supports it and pushing targets towards weaker authentication methods. The operator, using the alias ‘General Boss’, also deployed geo-matched residential proxy pools across 69 countries, matching each victim’s location with a local residential IP address so that Microsoft’s authentication servers do not flag the login as suspicious, Infosecurity Magazine reported.
Real-time Telegram exfiltration bots piped stolen credentials directly to at least five affiliate operators as each compromise occurred. CloudSEK’s report, shared with BleepingComputer, puts the total haul at 5,137 credential records: 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies, drawn from 3,331 unique victim IP addresses across more than 40 countries.
Scope and Geography of the Campaign
While 461 organisations appeared in the broader targeting dataset, CloudSEK clarified that 258 distinct organisations had at least one completed MFA-bypass compromise. Among the most affected countries were India, France, Saudi Arabia, New Zealand and Germany, according to eSecurityPlanet.
The infrastructure underpinning the BigBear 2.0 MFA bypass campaign comprised 42 virtual private server (VPS) nodes, all configured to target Microsoft 365. According to International Security Journal, 26 of those 42 nodes had been deleted from the panel since late July, suggesting some dismantling of the operation is under way, though CloudSEK noted the administration panel remained online and the campaign was still active at the time of writing. The phishing infrastructure itself had been offline for nearly three weeks at the time of publication.
Microsoft 365 is a cloud productivity and identity ecosystem incorporating Exchange Online, Teams, SharePoint, OneDrive, and Entra ID authentication. A hijacked authenticated session can expose email and files while potentially granting access to other applications connected through single sign-on, making these credentials particularly valuable to attackers.
Response and Recommended Defences
CloudSEK said it notified law enforcement and several affected organisations, and included the credentials in responsible-disclosure reports. For organisations that may have been targeted, CloudSEK recommends resetting exposed passwords, revoking active sessions, refreshing tokens, and forcing re-authentication for high-privileged accounts.
Given that BigBear actively works to suppress FIDO2/WebAuthn in browsers, enforcing phishing-resistant FIDO2/WebAuthn at the policy level (rather than relying on browser-side behaviour) is advisable. Conditional Access policies that require managed devices are also recommended over geo-location signals, which the platform’s residential proxy pools are specifically designed to mimic. The partial teardown of VPS nodes since late July is the most concrete sign of operational disruption so far.
