BigBear phishing crew nets thousands of Microsoft 365 credentials

BigBear 2.0 is an active Evilginx2-based phishing-as-a-service campaign targeting Microsoft 365 users; researchers who accessed the operation's admin panel found 5,137 stolen records from 461 organizations (1,032 plaintext passwords, 4,148 session cookies) including 474 authenticated sessions that enable MFA bypass. The infrastructure uses JavaScript to discourage FIDO2/WebAuthn, a global residential proxy pool to mask geolocation, multi-user leasing to affiliates, and real-time exfiltration via Telegram, posing high risk for account takeover, business email compromise, data theft, and lateral access to cloud resources.