Affected Systems

Microsoft 365 users across 258 organizations in 40+ countries. All authentication methods except FIDO2/WebAuthn hardware tokens are vulnerable. Campaign leverages Evilginx2-based adversary-in-the-middle (AiTM) framework with geo-matched residential proxies across 69 countries.

Exploitation Status

Active exploitation confirmed. BigBear 2.0 phishing-as-a-service platform operational with at least five affiliate operators. 5,137 credential records exfiltrated including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies. Administration panel remains online as of report publication, though phishing infrastructure offline for three weeks.

Business Impact

Attackers gain full authenticated access to Microsoft 365 sessions, bypassing traditional MFA (SMS, app-based codes). Compromised accounts expose Exchange Online email, Teams messages, SharePoint/OneDrive files, and potentially downstream applications via single sign-on. BigBear uses custom JavaScript to disable FIDO2/WebAuthn browser functionality, forcing victims to weaker authentication methods. Geo-matched residential proxies evade Microsoft's location-based anomaly detection.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit Microsoft 365 sign-in logs (Entra ID) for suspicious authentication patterns, particularly sessions originating from residential IP ranges or geo-mismatched locations within short timeframes
  • Force password resets and revoke all active sessions and refresh tokens for accounts flagged in sign-in anomaly reviews, prioritizing high-privileged and admin accounts
  • Deploy phishing-resistant FIDO2/WebAuthn hardware tokens (e.g., YubiKey, Windows Hello for Business) and disable legacy MFA methods (SMS, voice, app-based OTP) via Entra ID authentication methods policy
  • Implement Conditional Access policies requiring managed/compliant devices for Microsoft 365 access, removing reliance on geo-location or IP reputation signals alone
  • Monitor for JavaScript injection attempts targeting authentication flows and consider deploying browser isolation or endpoint detection rules flagging WebAuthn API tampering