A Phishing Service Just Bypassed MFA at 258 Organizations. The Real Story Is How It Works.

Here's the version of this story that gets the headlines: a phishing service called BigBear 2.0 bypassed multi-factor authentication at 258 organizations and walked away with more than 5,000 Microsoft 365 credentials. That's the easy narrative, and it's technically true. It's also the wrong one.

The real story is that BigBear didn't bypass MFA at all. It didn't crack a code, didn't find a flaw in the protocol, didn't outsmart a security key. It did something far more insidious — it sat in the middle of a legitimate login and waited for the victim to pass MFA themselves, then stole the session that MFA had just blessed.

The Breakthrough: A Panel You Can Read

CloudSEK's TRIAD team didn't just observe this campaign from the outside. They got administrator access to the attacker's own control panel. That's the difference between reading a threat report and reading the attacker's ledger.

What the ledger shows is a business. BigBear 2.0 is a phishing-as-a-service operation run by an operator using the alias "General Boss." It managed 42 VPS nodes — hosted primarily by Vultr — all configured with a single phishlet called "offy" that targets Microsoft 365 exclusively. The panel is leased to at least five affiliate operators, each receiving stolen credentials in real time through their own Telegram exfiltration bots.

This is a subscription product with a dashboard, not a script a criminal downloads and self-hosts.

The Deep Dive: The 5,137-Record Ledger

Here's what the panel had exfiltrated at the time of analysis: 5,137 credential records. That breaks down to 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies — affecting 3,331 unique victim IPs across more than 40 countries. India led the targeting with 658 records, followed by France and Saudi Arabia.

The mechanism is the part that should keep security teams up at night. BigBear uses an Evilginx2-based adversary-in-the-middle proxy. When a victim clicks the phishing link, the proxy relays everything between their browser and Microsoft's real login page. The victim enters their email, their password, completes their MFA challenge — a push notification, a TOTP code, an SMS — and Microsoft issues a session cookie. The proxy captures that cookie in transit and replays it through an API to hijack the session.

The attacker never needs the TOTP code. They never need the SMS code. They just need to wait for the victim to complete MFA on a page that looks exactly like Microsoft's, because it is Microsoft's.

The panel's own metrics confirm how well this works: 80% of password entries resulted in session cookie capture.

But there's more, and it's the detail that makes this campaign genuinely different. BigBear injects custom JavaScript into every proxied login page. One injection disables FIDO2/WebAuthn entirely — it monkey-patches the browser's credential API so hardware security key users are forced to fall back to weaker, phishable MFA. Another blocks Microsoft's anti-phishing telemetry and canary tokens so the platform can't detect the ongoing attack. A third auto-checks "Keep Me Signed In" to maximize the session cookie's lifetime.

Then there's the evasion layer. The panel deploys geo-matched residential proxies for 69 countries, routing the victim's traffic to Microsoft through a residential IP in their own country. Microsoft's authentication servers see a login from the right place, from the right kind of network, and flag nothing. The operator even deleted 26 of the 42 VPS nodes in late July — active counter-forensics in response to detection.

The Strategic Tension: The Only MFA That Holds

Here's the uncomfortable truth buried in this campaign: TOTP, push notifications, SMS, and voice-call MFA are all equally vulnerable. The proxy doesn't defeat the cryptographic challenge. It captures the session token that the challenge produces. The one exception is FIDO2/WebAuthn — hardware security keys and platform authenticators — because the cryptographic assertion is bound to the origin domain. When the proxy changes the origin, the assertion fails.

That's the tension. The MFA most organizations have deployed — the push notification that makes everyone feel secure — is exactly the MFA this attack is built to route around. The fix isn't a stronger one-time code. It's phishing-resistant MFA, Conditional Access policies that require managed devices, and revoking sessions and refresh tokens rather than just resetting passwords.

CloudSEK has notified law enforcement and affected organizations. The panel remains online at the time of writing, even as the phishing infrastructure has been offline for nearly three weeks. The capability hasn't gone anywhere — it's a product, and products get re-deployed.

The Synthesis

What BigBear represents isn't a new vulnerability. It's the industrialization of a technique that's been documented for years, packaged into a subscription that a criminal with a Telegram account and no technical background can rent. The barrier to entry for bypassing MFA has collapsed to the price of a monthly license.

The organizations that got hit weren't careless. They had MFA enabled — that's the whole point. They were running the security control that most of the industry still treats as sufficient, and it wasn't. The gap between the MFA you think you have and the MFA that actually holds is the real story here, and it's a gap that only gets wider as these platforms get cheaper and more polished.

Closing that gap is a hard, unglamorous problem — it means rethinking identity controls, not just adding another factor. It's the kind of problem that doesn't show up in a vendor's feature list. At DMC, we work with companies navigating exactly these constraints — hardening identity and authentication posture when the threat model has moved past the controls everyone assumed were enough. Need help stress-testing your identity roadmap? Let's talk.