News Date: 2026-09-07
A phishing-as-a-service operation known as BigBear 2.0 has turned Microsoft 365 account theft into a scalable commercial offering. Researchers examining its administration panel found infrastructure designed to place an attacker-controlled proxy between victims and Microsoft's legitimate sign-in service, allowing the platform to capture passwords, authentication activity and reusable session cookies.
Authentication succeeded, but trust was stolen
The important distinction is that BigBear does not necessarily break multifactor authentication. Instead, it intercepts the authenticated session created after a user completes the required verification. The stolen cookie can then allow an operator to assume the victim's identity without repeating the original sign-in process.
Researchers linked the platform to 42 virtual private servers configured for Microsoft 365 phishing. The collected records reportedly included thousands of passwords and session cookies, with 258 organizations experiencing at least one completed MFA-bypass compromise. The service also used residential proxies matched to victims' geographic locations, reducing the chance that location-based security rules would identify the subsequent access as suspicious.
BigBear's operators reportedly attempted to interfere with FIDO2 and WebAuthn functionality so that victims would be pushed toward weaker authentication options. This reinforces an uncomfortable lesson: merely making phishing-resistant authentication available is not the same as requiring it.
What defenders should do
- Enforce phishing-resistant passkeys or hardware-backed FIDO2 authentication wherever possible.
- Require managed and compliant devices through Conditional Access policies.
- Monitor for unusual session-cookie reuse, token replay and rapid changes in network origin.
- Revoke active sessions and refresh tokens after suspected phishing, rather than only resetting passwords.
- Apply stricter controls to administrators and other accounts with access to sensitive email, files or applications.
In my view, BigBear is another warning that MFA should be treated as one layer of identity security, not the final boundary. Organizations need to evaluate the device, session and requested resource continuously. If a valid session cookie automatically receives broad trust, attackers will continue targeting that cookie instead of trying to defeat the authentication factor itself.