Loading story…
CloudSEK reported that BigBear 2.0, a phishing-as-a-service platform allegedly operated by “General Boss,” used a rebranded Evilginx2 adversary-in-the-middle (AiTM) framework to target Microsoft 365 users. Its offy proxy intercepted passwords and post-MFA session cookies, allowing attackers to replay authenticated sessions and bypass MFA. Researchers found 5,137 captured credential records tied to 461 organizations and 3,331 victim IP addresses across more than 40 countries; IT services firms and managed service providers were the most targeted, with India accounting for the largest share of victims.
The platform used a centralized multi-tenant administration panel controlling 42 VPS nodes and supplied stolen credentials to at least five affiliates through Telegram. BigBear 2.0 also deployed custom JavaScript intended to suppress FIDO2/WebAuthn prompts, block Microsoft anti-phishing telemetry, and select “Keep Me Signed In,” while geo-matched residential proxies helped evade location-based controls. Organizations should investigate suspicious Microsoft 365 session activity and prioritize detection of Evilginx/BigBear cookie and header artifacts, associated infrastructure, and Telegram-based credential-exfiltration traffic.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
After accessing the BigBear 2.0 administrative panel, CloudSEK reported 5,137 stolen records tied to 461 organizations, including 474 complete authenticated sessions and 4,148 session cookies. It also identified 42 VPS nodes, at least five affiliates, and campaign infrastructure and Telegram bot indicators.
CloudSEK's TRIAD discovered BigBear 2.0, describing it as a rebranded Evilginx2-based phishing-as-a-service platform operated under the alias "General Boss." The platform used the "offy" adversary-in-the-middle configuration against Microsoft 365 authentication, capturing passwords and post-MFA session cookies for replay.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcemalware.news
Open sourcecloudsek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Forg365**, a phishing-as-a-service platform marketed through Telegram, is targeting **Microsoft 365** and other Microsoft accounts with a mix of adversary-in-the-middle phishing, **device-code phishing**, session theft, and post-compromise mailbox access. The service includes an operator panel with AI-assisted lure generation, impersonation templates for Microsoft services, SMTP rotation, campaign scheduling, token storage, and mailbox keyword monitoring, giving attackers an end-to-end workflow for credential theft and account takeover. Investigators said Forg365 can capture authentication tokens, browser cookies, and session data, while a companion browser extension, **ForgCookie**, refreshes Microsoft single sign-on cookies to preserve access without repeated reauthentication. Observed infrastructure included **Amazon SES** for email delivery, **SendGrid**-hosted resources, **Cloudflare Pages** landing pages, and **Gophish** components, alongside anti-analysis measures such as bot detection, debugger traps, sandbox checks, encrypted redirectors, and VPN-based benign redirection. Defenders were urged to restrict device-code authentication where possible, monitor **Microsoft Entra** logs, OAuth and Microsoft Graph activity, suspicious device registrations, and rapidly revoke sessions, refresh tokens, and OAuth access after suspected compromise.
Jul 14, 2026
A widespread phishing campaign is compromising **Microsoft 365** accounts with adversary-in-the-middle login pages that capture session material even when MFA is enabled, then using those identities to target payroll, HR, finance, and administrative staff across healthcare, education, manufacturing, government, and professional services in the United States, Canada, and Europe. Arctic Wolf said the activity aligns technically and behaviorally with Microsoft-tracked **Storm-2755** (also known as **Payroll Pirates**), with attackers maintaining access through rotating residential proxies and automated session activity roughly every eight hours while quietly collecting mailbox data tied to financial workflows. Reporting also shows the intrusions can progress without additional device compromise, shifting instead into **identity-plane lateral movement** inside **Entra ID** and Microsoft 365. After an initial phish, attackers can use stolen session tokens to enumerate the tenant through **Microsoft Graph**, register a malicious Entra ID application, create a service principal, grant permissions such as `Mail.Read` and `Mail.Send`, and access other users’ mailboxes, including executives, before sending fraudulent messages through Graph API that pass SPF and DKIM checks. Defenders were urged to correlate cloud identity, Graph, sign-in, and email telemetry for signals including **OfficeHome error 90014**, anomalous Outlook sign-ins with **Firefox** user agents, repeated `SessionID` reuse across changing IPs and geographies, suspicious app registrations, credential additions to service principals, and unusual application access to user mailboxes.
Aug 10, 2026
Three phishing-as-a-service platforms—**Sneaky 2FA**, **EvilTokens**, and **EvilProxy**—are targeting U.S. organizations to steal Microsoft 365 credentials and authenticated access by capturing session cookies or OAuth tokens after users complete legitimate sign-ins. The kits use different methods, including adversary-in-the-middle session hijacking, abuse of Microsoft’s OAuth 2.0 device authorization flow, and reverse-proxy credential relay, allowing attackers to gain access without breaking MFA cryptographically. Researchers said **EvilTokens**, which emerged in 2026, has already been linked to compromises at more than **340 Microsoft 365 organizations** across at least seven countries, while **EvilProxy** has been used in campaigns against executives and managers at more than **100 organizations**. The campaigns show that standard MFA does not stop phishing when attackers steal the resulting authenticated session artifact instead of the password alone. **Sneaky 2FA** reportedly uses CAPTCHA gates, IP filtering, and cloned Microsoft login pages to evade detection, while the broader activity has created detection opportunities around impossible device-shift patterns, anomalous token use, and suspicious device-code prompts. Defenders are being urged to deploy **phishing-resistant MFA** such as **FIDO2/WebAuthn**, restrict or disable unnecessary device-code authentication in **Entra ID**, and closely monitor Microsoft 365 environments for unexpected MFA prompts and token abuse.
Aug 5, 2026