BigBear Didn’t Break Microsoft 365. It Just Stole the Session After MFA

• The Mess: BigBear 2.0 is a phishing-as-a-service operation built around adversary-in-the-middle attacks that steal Microsoft 365 sessions after victims complete MFA.
• The Damage: The operators don’t need your password twice. Once they capture the authenticated session, MFA has already done its job — for the attacker.
• The Fix: Block the phishing infrastructure, revoke active sessions, rotate compromised credentials and investigate token theft instead of assuming MFA stopped the intrusion.

MFA wasn’t broken.

The attackers just waited until it finished.

Researchers at CloudSEK uncovered BigBear 2.0, a phishing-as-a-service operation built around Evilginx2-style adversary-in-the-middle infrastructure. The operation targeted Microsoft 365 users across more than 40 countries and exposed the scale of an attack model that doesn’t need to defeat MFA cryptographically.

It simply steals the authenticated session after the victim passes it.

CloudSEK says its investigation identified more than 5,000 compromised Microsoft 365 credentials linked to the operation and activity affecting 258 organizations.

The Password Isn’t the Prize Anymore

Traditional phishing wants credentials.

AiTM phishing wants something better.

The victim visits a fake Microsoft 365 login page. The phishing server sits between the victim and the legitimate authentication service, relaying the login process in real time.

The victim enters the password.

The victim completes MFA.

The session gets authenticated.

Then BigBear captures the session cookies or authentication tokens.

At that point, the attacker may no longer need to ask for the password again.

The attacker already has proof that the authentication process succeeded.

That’s the ugly part of modern AiTM phishing.

MFA can work exactly as designed and the account can still be compromised.

BigBear Is Selling the Infrastructure

BigBear 2.0 isn’t just a collection of phishing pages.

According to CloudSEK, the operation provides infrastructure and tooling for affiliates, including phishing resources and infrastructure designed to support session theft campaigns at scale.

That matters because phishing-as-a-service lowers the barrier.

An affiliate doesn’t need to build an Evilginx deployment from scratch.

They don’t need to understand reverse proxies.

They don’t need to develop the management infrastructure.

Someone else already did the engineering.

The affiliate just needs victims.

And Microsoft 365 remains one of the most valuable targets available.

One compromised account can expose email, documents, cloud resources, internal conversations and additional credentials.

MFA Protected the Login. Not the Session.

This distinction keeps getting lost.

MFA protects the authentication event.

It does not automatically protect a stolen authenticated session.

If an attacker captures a valid session token after the victim authenticates, the attacker may be able to replay that session.

From the service’s perspective, the attacker isn’t guessing a password.

The attacker is presenting an already authenticated session.

That is why AiTM phishing has become such an effective model against cloud identity platforms.

The attack doesn’t necessarily defeat MFA.

It routes around it.

What Defenders Should Look For

If BigBear-style infrastructure is involved, investigating only failed logins is the wrong approach.

Look for:

• suspicious sign-ins after successful MFA,
• impossible or unusual session changes,
• new device registrations,
• abnormal OAuth or session activity,
• unexpected mailbox rules,
• token reuse from different infrastructure,
• activity immediately following a successful authentication event.

CloudSEK’s research also highlights the importance of tracking phishing infrastructure and the operational ecosystem behind it, rather than treating every fake login page as an isolated campaign.

Because these operations are increasingly platforms.

The phishing page is just the front end.

Bugstoday Opinion

For years, security teams told users:

Use MFA and stolen passwords become far less useful.

That was true.

Then phishing operators changed what they steal.

BigBear 2.0 is a reminder that identity attacks are moving away from password guessing and toward session theft.

The victim can do everything right.

Use a strong password.

Complete MFA.

Log in to what looks like the correct service.

And still hand the attacker a valid session.

The dangerous part isn’t that BigBear discovered a new flaw in Microsoft 365.

It didn’t need one.

It attacked the part between the user and the browser session.

And that’s becoming one of the most profitable places for phishing crews to operate.

MFA stopped being the finish line. Attackers moved the finish line to the session cookie.

Today’s Bugs. Tomorrow’s Breaches.

Sources

• CloudSEK — BigBear 2.0 phishing infrastructure analysis
• Microsoft — adversary-in-the-middle phishing and session-token theft guidance