Loading threat actor…
General Boss is a cybercriminal operator associated with BigBear 2.0, an Evilginx2-based phishing-as-a-service platform targeting Microsoft 365 and Microsoft Entra ID authentication. The service uses adversary-in-the-middle phishing to proxy victim authentication, steal passwords and MFA-authenticated session cookies, and enable replay of captured cloud sessions. BigBear 2.0 employs a multi-tenant affiliate model, with multiple operators receiving collected authentication material through dedicated Telegram bots. Its infrastructure uses geographically matched residential proxies to reduce location-anomaly detections. Custom browser-side modifications suppress WebAuthn/FIDO2 authentication flows, interfere with Microsoft anti-phishing telemetry, and extend stolen-session usability through persistent-sign-in and session-maintenance features. Operations targeted hundreds of organizations across more than 40 countries, particularly IT services and managed service providers, SaaS and technology organizations, oil and gas, pharmaceutical, and consulting organizations. India, France, and Saudi Arabia were among the most affected countries.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families attributed to this actor across reporting.
52 indicators attributed to this actor. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.