GoKawiilBigBear 2.0 phishing kit steals 5,000+ Microsoft 365 logins across 258 firms
CloudSEK researchers infiltrated the admin panel of a phishing-as-a-service tool called BigBear 2.0 and found it had harvested over 5,000 Microsoft 365 credentials from 258 organizations. The kit uses an Evilginx2-based adversary-in-the-middle proxy to intercept usernames, passwords, and session cookies even after victims complete multi-factor authentication, letting attackers replay stolen sessions to hijack accounts.
GoKawiil's interpretation of the reporting above, not reported fact.
This shows MFA alone is no longer a reliable shield against phishing when attackers use session-hijacking proxies instead of just guessing passwords. Because BigBear is rented out to at least five affiliate operators via Telegram, the same infrastructure can spawn many parallel campaigns, amplifying the scale of Microsoft 365 account takeovers and downstream access to email, files, and connected SSO apps.
- BigBear 2.0 bypassed MFA to steal 474 fully authenticated sessions and over 4,000 cookies.
- The service ran 42 VPS nodes and compromised victims in more than 40 countries.
- It's sold as phishing-as-a-service to multiple affiliates, increasing the threat's reach.
Yubico YubiKey 5 NFC Security Key — Adversary-in-the-middle kits like BigBear 2.0 work because push and code-based MFA can be relayed through a proxy — but FIDO2/WebAuthn hardware keys bind the login to the real domain, so a fake Microsoft 365 page gets nothing. The YubiKey 5 NFC plugs into USB-A or taps on a phone and works with Entra ID, Google, and password managers. It's a small, practical upgrade for anyone tired of phishable one-time codes.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-07
Published there as: “BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.