BigBear Microsoft 365 phishing service bypasses MFA at 258 organizations

{"heading_1":"Phishing-as-a-Service Framework","paragraph_1":"BigBear 2.0 is a phishing-as-a-service (PhaaS) framework that uses an Evilginx2-based adversary-in-the-middle (AiTM) framework to intercept passwords and authenticated session cookies.","paragraph_2":"The service manages 42 virtual private servers (VPS) nodes, all configured to target Microsoft 365 as part of the observed operation.","paragraph_3":"The service uses a configuration called 'offy' to set up a man-in-the-middle (AiTM) proxy between the victim and Microsoft's legitimate authentication infrastructure.","paragraph_4":"This allows the attacker to capture credentials, including MFA, and session cookies and replay them through an API to hijack the victim's authentication session.","paragraph_5":"The service uses geo-matched residential proxies for 69 countries to match the victim's location with a residential IP address, making the activity less suspicious to Microsoft's authentication servers."}