Tracking BigBear 2.0 Evilginx2 Phishing Campaign
ID: a6f36443-858a-5d1e-a4cd-c0fb264c2ddd
STIX ID: report--a6f36443-858a-5d1e-a4cd-c0fb264c2ddd
Feed Name: CloudSEK Blog
Threat Score
**Executive Summary:** CloudSEK TRIAD uncovered "BigBear 2.0", an active Evilginx2-based phishing-as-a-service operation that intercepted 5,137 credential records (including 474 full MFA-bypassed sessions) across 461 organizations and 3,331 unique IPs in 40+ countries, leveraging 42 VPS nodes, geo-matched residential proxies, Telegram exfiltration bots, and custom JavaScript to disable FIDO2/WebAuthn and evade telemetry.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.