Cybersecurity researchers at CloudSEK gained access to the administration backend of BigBear 2.0, an active phishing-as-a-service campaign, uncovering more than 5,100 compromised user records and session tokens belonging to 461 organizations targeting Microsoft 365.
The breach highlights how adversary-in-the-middle proxy frameworks bypass traditional multi-factor authentication mechanisms. CloudSEK revealed that the platform captured over 1,000 plaintext passwords and 4,100 session cookies, granting attackers direct access to corporate communications, cloud storage, and federated directory systems.
Infiltration of the BigBear 2.0 Admin Panel
CloudSEK's investigation into the BigBear 2.0 administration console exposed the mechanics and scale of the active phishing infrastructure. The researchers identified 5,137 total stolen records linked to 461 distinct corporate environments. Among these records, 1,032 contained plaintext passwords, while 4,148 were captured session cookies designed to sustain unauthorized session persistence.
Crucially, CloudSEK isolated 474 records categorized as complete, multi-factor authentication-bypassed authentications. In these instances, victims successfully completed secondary authentication steps, allowing the BigBear infrastructure to intercept full session tokens. Rather than being an archival record of a historical attack, the dashboard indicated an active cybercrime operation leveraging a default phishing template named "offy" designed specifically to mirror Microsoft 365 login flows.
Bypassing MFA with Adversary-in-the-Middle Proxies
BigBear 2.0 operates using modified components of the open-source Evilginx2 framework, deploying an adversary-in-the-middle proxy infrastructure between victims and Microsoft’s official authentication servers. When a targeted user accesses a phishing link, the system proxies Microsoft's actual login interface in real time, capturing entered credentials and relaying secondary security challenges directly to the user.
Once the victim completes the challenge, Microsoft issues an authenticated session cookie, which flows back through the attacker’s proxy before reaching the user. The platform captures this session cookie, giving cybercriminals the ability to replay the authenticated session and gain access to Microsoft 365 services without triggering subsequent multi-factor authentication prompts until the token expires or is forcibly revoked by enterprise administrators.
Technical Customizations and Anti-Evasion Tactics
According to CloudSEK security researcher Gagan Aggarwal, BigBear’s operators incorporated bespoke technical modifications beyond standard Evilginx2 implementations. The platform deploys custom JavaScript designed to systematically disable hardware-based FIDO2 and WebAuthn authentication protocols on its phishing landing pages. This manipulation forces victims toward less secure authentication channels, such as SMS verification codes, push notifications, and time-based one-time passwords, which remain vulnerable to proxy interception.
To evade geographic anomaly detection and security telemetry, BigBear utilizes a global residential proxy pool spanning 69 countries. For example, if a targeted employee logs in from India, the infrastructure routes the upstream connection to Microsoft through a local Indian residential IP address, preventing location-based alert triggers. Furthermore, the system executes automated checks to filter out incoming traffic originating from datacenters, virtual private networks, and known proxy services, deliberately blocking automated security scanners and intelligence analysts.
Commercial Model and Cybercrime Ecosystem
The underlying infrastructure behind BigBear functions as a phishing-as-a-service commercial model managed via a multi-user administrative portal. CloudSEK observed that the primary developer leased access to at least five distinct affiliate operators. Stolen credentials and hijacked session tokens were exfiltrated in real time to subscribers using dedicated Telegram bots configured for automated delivery.
Throughout its operational life cycle, researchers tracked 42 Virtual Private Server nodes supporting the network. System logs revealed that 26 nodes had been systematically dismantled or deleted from the central panel since late July, leaving a single active server at the time of CloudSEK’s inspection. Aggarwal noted that the overall operation is led by an actor operating under the alias "General Boss," with evidence pointing toward financial gain rather than state-sponsored cyber espionage.
Enterprise Exposure and Defense Strategies
Compromised Microsoft 365 accounts give attackers expansive access across enterprise environments, reaching far beyond basic email inboxes. Hijacked sessions expose internal calendars, Microsoft Teams chats, and sensitive documents stored in SharePoint and OneDrive repositories. Depending on account privilege levels, stolen access tokens can provide lateral mobility into Entra ID directory services, broad cloud infrastructure, and integrated third-party Software-as-a-Service applications.
To counter adversary-in-the-middle phishing platforms, security analysts emphasize that organizations must adopt phishing-resistant authentication controls. CloudSEK recommends deploying strict FIDO2 or WebAuthn hardware keys, enforcing robust conditional access policies, and mandating compliant device verification. Additionally, security teams must establish rapid incident response procedures capable of immediately revoking active session and refresh tokens whenever credential compromise or suspicious session replays are detected.
