Security researchers at CloudSEK gained access to the control panel of a phishing-as-a-service operation called BigBear 2.0 and found it had compromised 258 organizations across more than 40 countries, bypassing multi-factor authentication in the process. The kit works as an adversary-in-the-middle proxy: it sits between a victim and Microsoft's real login page, so when someone types their password and approves an MFA prompt, the attacker's server captures the password, the MFA code, and the resulting session cookie in real time. That stolen session cookie is the key part — it lets the attacker log in as the victim without needing a password or MFA code ever again, until the session is revoked. Some versions of the kit went further, using scripts to disable FIDO2/WebAuthn security-key prompts in the browser so victims were pushed toward weaker, phishable login methods instead.
CloudSEK reported the operation exfiltrated 5,137 credential sets in total, including 474 fully MFA-bypassed logins, before reporting its findings to law enforcement and the affected organizations. The phishing pages were built to closely mimic genuine Microsoft 365 sign-in screens and were distributed through convincing lure emails, making them hard for an untrained eye to spot. Once inside, this style of attack is commonly used to read email, redirect invoices, or pivot into other systems the victim's account has access to through single sign-on.
What this means for your business
If your team logs into Microsoft 365 (or Google Workspace, which faces the same style of attack), password-plus-MFA is no longer enough on its own — this kit is built specifically to get past it. The strongest practical defence is phishing-resistant authentication: hardware security keys or platform passkeys (FIDO2/WebAuthn) instead of SMS or app-based one-time codes, since those can't be relayed through a proxy the way a six-digit code can. Pair that with a Conditional Access policy that only allows sign-in from managed or previously-recognised devices, and train staff to check the address bar before entering credentials on any login page reached through an email link. If you suspect an account may have been touched, don't just reset the password — revoke active sessions and refresh tokens too, since a stolen session cookie survives a password change. If nobody has reviewed your tenant's Conditional Access and MFA setup recently, this is a reasonable week to ask.