BigBear phishing operation reportedly bypassed MFA at 258 organizations

CloudSEK researchers said the BigBear 2.0 phishing-as-a-service operation bypassed multi-factor authentication at 258 organizations and collected more than 5,000 Microsoft 365 credential records. The researchers said the operation used an Evilginx2-based adversary-in-the-middle proxy to intercept passwords and authenticated session cookies after victims completed MFA. CloudSEK reported 474 complete MFA-bypassed authentications, 1,032 plaintext passwords and 4,148 session cookies. It said it notified law enforcement and affected organizations; the administration panel remained online, though the phishing infrastructure had been offline for nearly three weeks.