BigBear 2.0 AiTM Service Stole Microsoft 365 Credentials and MFA Sessions

CloudSEK reported that BigBear 2.0, a phishing-as-a-service platform allegedly operated by “General Boss,” used a rebranded Evilginx2 adversary-in-the-middle (AiTM) framework to target Microsoft 365 users. Its offy proxy intercepted passwords and post-MFA session cookies, allowing attackers to replay authenticated sessions and bypass MFA. Researchers found 5,137 captured credential records tied to 461 organizations and 3,331 victim IP addresses across more than 40 countries; IT services firms and managed service providers were the most targeted, with India accounting for the largest share of victims.

The platform used a centralized multi-tenant administration panel controlling 42 VPS nodes and supplied stolen credentials to at least five affiliates through Telegram. BigBear 2.0 also deployed custom JavaScript intended to suppress FIDO2/WebAuthn prompts, block Microsoft anti-phishing telemetry, and select “Keep Me Signed In,” while geo-matched residential proxies helped evade location-based controls. Organizations should investigate suspicious Microsoft 365 session activity and prioritize detection of Evilginx/BigBear cookie and header artifacts, associated infrastructure, and Telegram-based credential-exfiltration traffic.