Loading threat actor…
BigBear 2.0 is a phishing-as-a-service operation built on the Evilginx2 adversary-in-the-middle framework and focused on Microsoft 365 accounts. It has been attributed to an operator using the alias General Boss, who shared access with at least five affiliates. The operation uses a Microsoft 365-targeting phishlet to proxy legitimate authentication flows, capture credentials and MFA-authenticated session cookies, and replay stolen cookies to hijack authenticated sessions. It uses geo-matched residential proxies to reduce geographic anomaly detection and real-time Telegram-based delivery of captured data to operators and affiliates. JavaScript modifications have been used to steer victims away from FIDO2/WebAuthn authentication, interfere with anti-phishing detection mechanisms, and select persistent sign-in options that extend the usefulness of stolen sessions. BigBear 2.0 has targeted organizations in more than 40 countries, with India most affected and IT services and managed service providers particularly impacted. Compromised Microsoft 365 sessions can enable access to email, collaboration, cloud-storage, identity, and connected single-sign-on services, creating downstream risk for managed-service-provider customers.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.