Phishing-as-a-Service Platform BigBear Bypasses MFA at 258 Organizations to Hijack Microsoft 365 Accounts

CloudSEK researchers infiltrated the BigBear 2.0 phishing panel to find attackers successfully compromised 258 organizations by bypassing multi-factor authentication. The service exfiltrated 5,137 records, including 4,148 session tokens and 474 completed MFA-bypassed authentications. BigBear sets up an adversary-in-the-middle proxy to intercept the authentication traffic between the victim and Microsoft's legitimate infrastructure. Attackers use custom JavaScript to explicitly block FIDO2/WebAuthn functionality, forcing victims to fall back to weaker authentication methods. “The multi-user PhaaS panel is leased to at least five affiliate operators identified through live Telegram exfiltration bots, each receiving stolen credentials in real time.” — CloudSEK