A phishing-as-a-service framework identified as BigBear 2.0 has been used in a global campaign to bypass multi-factor authentication and compromise Microsoft 365 accounts at 258 organizations, resulting in the theft of more than 5,000 credentials. The operation leverages real-time token interception and proxy-based techniques to circumvent MFA protections, according to reporting by BleepingComputer.

What should defenders do?

Organizations are advised to implement phishing-resistant multi-factor authentication using FIDO2/WebAuthn standards, which are designed to resist phishing and token interception attacks. Additional recommendations include deploying conditional access policies to restrict sign-in risk, conducting regular user security awareness training to recognize phishing attempts, and monitoring sign-in logs for suspicious activity such as unfamiliar locations or failed MFA attempts. Microsoft Entra ID P1/P2 licenses provide advanced conditional access capabilities for enhanced protection.

highPhishing

BigBear 2.0 Phishing Service Bypasses MFA at 258 Organizations

Over 5,000 Microsoft 365 credentials stolen via real-time token interception and proxy-based authentication bypass techniques

CyberIntel DeskPublished 22 days agoUpdated less than a minute ago1 min read

BigBear 2.0 Phishing Service Bypasses MFA at 258 Organizations

Key Takeaways

BigBear 2.0 phishing-as-a-service framework bypassed MFA at 258 organizations globally.
Over 5,000 Microsoft 365 credentials were stolen in the campaign.
Techniques observed include real-time token interception and proxy-based authentication bypass.
The reported scale requires verification from Microsoft and affected organizations.
Security experts recommend phishing-resistant MFA (FIDO2/WebAuthn) and conditional access policies as mitigations.

Related Security News

highCyber Attacks

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

BleepingComputerabout 5 hours ago1 min read