GoKawiilBigBear 2.0 phishing kit steals 5,000+ Microsoft 365 logins across 258 firms
CloudSEK researchers infiltrated the admin panel of a phishing-as-a-service tool called BigBear 2.0 and found it had harvested over 5,000 Microsoft 365 credentials from 258 organizations. The kit uses an Evilginx2-based adversary-in-the-middle proxy to intercept usernames, passwords, and session cookies even after victims complete multi-factor authentication, letting attackers replay stolen sessions to hijack accounts.