CloudSEK’s researchers have revealed that a global Microsoft 365 phishing operation dubbed BigBear 2.0 has exposed 5,137 credential records across 461 organisations, including 4,148 session cookies, 1,032 plain text passwords and 474 completed MFA-bypassed authentications.
The campaign affected 3,331 unique victim IPs across more than 40 countries, with India, France, Saudi Arabia, New Zealand and Germany among the leading geographies.
What makes the investigation particularly significant is that CloudSEK researchers gained access to the attacker’s administrative panel, giving them a rare inside view of how the operation was being run, including its infrastructure, affiliate network, credential collection and session-hijacking workflow.
A phishing service built to steal authenticated sessions
The platform, called BigBear 2.0, is built on the well-known open-source Evilginx2 adversary-in-the-middle phishing framework to target Microsoft 365 accounts and is rented out to other criminals.
Instead of simply stealing passwords, the researchers said that the phishing infrastructure sits between the victim and Microsoft’s legitimate login service.
Once the victim completes the login and MFA process, the attacker can capture the authenticated session cookie and potentially reuse it to access the account without asking for the MFA code again.
The panel was observed managing 42 VPS nodes during the campaign lifecycle and using residential proxy infrastructure across 69 countries to make malicious login traffic appear closer to the victim’s real location.
At least five affiliate operators identified
The investigation also uncovered a wider phishing-as-a-service ecosystem.
CloudSEK revealed that it identified at least five active affiliate operators receiving stolen credentials through dedicated Telegram bots.
The panel supported separate user and admin roles, with infrastructure assigned to different operators, indicating that BigBear 2.0 was being operated as a service rather than as a single phishing campaign.
The platform also automated the flow of stolen information from the phishing page to Telegram and into a cookie-replay system, allowing attackers to move quickly from credential theft to session hijacking.
India recorded the highest volume
India was the most heavily represented country in the dataset, with 658 records or 12.8% of the total, followed by France with 463 records and Saudi Arabia with 353.
Among sectors, IT services and managed service providers were the most targeted, followed by SaaS and technology, oil and gas, pharmaceuticals and consulting.
Researcher’s said that this is particularly concerning because compromised IT service providers can potentially give attackers access to customer environments, cloud platforms, remote-management tools and other downstream systems.
Stolen sessions can lead to wider enterprise compromise
A hijacked Microsoft 365 session can potentially expose email, Teams, SharePoint, OneDrive, Entra ID and connected SaaS applications.
That access can then be used for business email compromise, financial fraud, internal phishing, data theft and further compromise of enterprise systems.
Researchers also observed signs that the operator was trying to reduce its footprint.
Since late July, 26 of the 42 VPS nodes observed during the campaign had been deleted from the panel.
What organisations should do
CloudSEK revealed that it recommends organisations to revoke suspicious session and refresh tokens, force re-authentication, reset compromised passwords and adopt phishing-resistant authentication such as FIDO2 or WebAuthn.
Stronger Conditional Access policies and compliant-device requirements can also reduce exposure.
CloudSEK is an AI-native predictive cyber intelligence platform that identifies attack paths and initial access vectors before they are exploited. The platform combines digital risk protection, cyber threat intelligence, external attack surface monitoring, AI attack surface monitoring and third-party risk intelligence to help organisations detect how attackers can gain access and disrupt attack paths before execution.