BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft
BigBear 2.0 is a phishing attack that tricks Microsoft 365 users into handing over their session cookies, bypassing multi-factor authentication. Attackers use fake sign-in pages to steal these cookies, gaining access to accounts even after users pass security checks.
- Report priority
- Medium
- Targets
- Microsoft
How it works
- Attackers send fake Microsoft 365 sign-in links via email.
- When clicked, these links open a fake page that looks like the real Microsoft login.
- The fake page collects the user's session cookie after they enter their password and pass multi-factor authentication.
- This cookie lets attackers log in without needing the password again, bypassing MFA.
What to do
If you clicked a suspicious Microsoft 365 sign-in link in an email and entered your credentials, check your Microsoft 365 account for any unusual activity, such as unexpected logins or changes to your settings. If you suspect you were targeted, reset your password immediately and enable additional security alerts in your Microsoft 365 account settings.
If you suspect your account was compromised, go to your Microsoft 365 account and reset your password right away. Enable multi-factor authentication if it's not already. Monitor your account for any strange activity, like emails sent from your address or changes you didn't make. If you're unsure whether your account was targeted, contact Microsoft Support for help.
Technical details
A victim receives an email with a link labeled 'Microsoft 365 Sign In.' When clicked, the link opens a fake login page that mimics Microsoft's real site. The victim enters their credentials and passes MFA. The attacker's server captures the session cookie, allowing them to log in later without further authentication.
BigBear 2.0 is a phishing campaign using the Evilginx2 framework to bypass Microsoft 365 multi-factor authentication (MFA) by stealing session cookies rather than compromising the authentication factor itself. Attackers lure victims to a fake Microsoft sign-in page hosted on a proxy server, which intercepts traffic between the user and the real Microsoft service. Once credentials are entered and MFA is completed, Microsoft returns an authenticated session cookie to the victim's browser.
The proxy captures this cookie, allowing attackers to replay it in another session and gain unauthorized access to the victim's Microsoft 365 account, including email, Teams, SharePoint, OneDrive, and connected SSO applications. Researchers at CloudSEK discovered the operation in June 2026, identifying 42 virtual private server nodes linked to an operator using the alias "General Boss." The campaign's administrative panel contained 5,137 stolen records from 461 organizations and 3,331 unique victim IP addresses across over 40 countries, including 474 complete authenticated sessions, 1,032 passwords, and 4,148 session cookies. The attack exploits the fact that MFA methods like push notifications or one-time codes only validate the user during the live session, while the proxy steals the resulting session cookie for persistent access.