Loading malware…
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CloudSek TRIAD discovered BigBear 2.0, a rebranded Evilginx2-based phishing-as-a-service framework. Its default "offy" phishlet intercepts Microsoft 365 authentication, captures credentials and session cookies, and supports automated cookie replay.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
T1583.001 — Acquire Infrastructure: Domains (Resource Development).
42 nœuds VPS ... avec gestion centralisée via un panneau multi-tenant.
BigBear 2.0 ... opération de phishing-as-a-service (PhaaS) basée sur le framework Evilginx2.
“Attacker replays the captured session cookie to access the victim's mailbox, Teams, SharePoint, and all connected SaaS applications — without triggering re-authentication.”
BigBear 2.0 ... configured with the 'offy' phishlet targeting Microsoft 365 exclusively.
“Victim clicks the phishing link (typically delivered via email) and is proxied to the legitimate Microsoft login page.”
“Attacker replays the captured session cookie to access the victim's mailbox, Teams, SharePoint, and all connected SaaS applications — without triggering re-authentication.”
T1098 — Account Manipulation (Persistence).
“BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations.”
“Attacker replays the captured session cookie to access the victim's mailbox, Teams, SharePoint, and all connected SaaS applications — without triggering re-authentication.”
T1098 — Account Manipulation (Persistence).
“Since late July 2026 the threat actor has deleted 26 of the 42 observed VPS nodes from the panel — evidence of active counter-forensic operations in response to detection.”
“Attacker replays the captured session cookie to access the victim's mailbox, Teams, SharePoint, and all connected SaaS applications — without triggering re-authentication.”
“BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations.”
Injections JavaScript personnalisées ... Désactivation de FIDO2/WebAuthn ... Blocage de la télémétrie anti-phishing Microsoft (events.data.microsoft.com, OneCollector).
“Victim enters password → proxy captures plaintext AND forwards to Microsoft.”
“Victim completes MFA ... → session token issued by Microsoft is captured by the proxy.”
“[It] steal[s] more than 5,000 Microsoft 365 credentials.”
“BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations.”
“Victim clicks the phishing link ... and is proxied to the legitimate Microsoft login page.”
“BigBear 2.0 uses an adversary-in-the-middle setup, meaning it sits between the victim and the real Microsoft login service.”
474 authentifications complètes avec contournement MFA ... API REST (/api/jobs) pour le replay automatisé de cookies.
“Victim enters password → proxy captures plaintext AND forwards to Microsoft.”
“Victim clicks the phishing link ... and is proxied to the legitimate Microsoft login page.”
“BigBear 2.0 uses an adversary-in-the-middle setup, meaning it sits between the victim and the real Microsoft login service.”
The operator, using the alias 'General Boss,' deployed geo-matched residential proxy pools.
“BigBear used country-matched residential proxies.”
69 proxies résidentiels géo-matchés par pays pour contourner la détection d’anomalies géographiques de Microsoft.
Exfiltration en temps réel via Telegram (bots dédiés par affilié) ... Le bot principal de C2 @comeandget_bot a été révoqué.
T1573.001 — Encrypted Channel: Symmetric Cryptography (Command and Control).
“Telegram bot @comeandget_bot [was the] Primary administrator command-and-control bot” and multiple other Telegram bots were identified as “Affiliate credential-exfiltration bot[s].”
52 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.