BigBear 2.0 phishing campaign compromises MFA

An Evilginx2-based phishing-as-a-service (PhaaS) campaign known as BigBear 2.0 has compromised the Microsoft 365 accounts of more than 3,300 victims, including accounts protected by multi-factor authentication (MFA), CloudSEK reported Monday.The campaign was uncovered after CloudSEK Threat Research and Information Analytics Division (TRIAD) researchers gained administrator access to the threat actor panel, revealing details about the BigBear 2.0 phishing kit, its victims and the operation’s use of virtual private server (VPS) infrastructure.BigBear 2.0 primarily uses a phishlet dubbed “offy,” a configuration for the Evilginx2 phishing reverse proxy that adds three custom JavaScript injections. This phishlet specifically targets Microsoft 365 accounts for adversary-in-the-middle (AiTM) MFA phishing.When a victim visits one of BigBear’s phishing websites, typically by clicking on a link in an email, login traffic is proxied between the phishing domain and the legitimate Microsoft login portal. As the user submits their responses, passwords and MFA session tokens are captured and relayed by the attacker. Related reading: The BigBear operation adds three custom injections to the Evilginx2 toolkit: one that prevents the use of FIDO2/WebAuthn passkeys, forcing users to fall back to phishable MFA methods, one that prevents Microsoft from use telemetry or canary tokens to detect the phishing attack and one that ensures the “Keep Me Signed In” option is automatically checked, extending the amount of time that phished session cookies will be usable, CloudSEK explained.The operation was found to be run as a PhaaS by a threat actor dubbed “General Boss” and the infiltrated panel was shared by at least five affiliates identified by their individual Telegram bot tokens, which were used to receive stolen credentials in real time.In total, CloudSEK identified 5,137 stolen records across all affiliates, including 474 complete MFA-authenticated sessions, 1,032 captured passwords and 4,148 session cookies across 3,331 unique victim IP addresses. These victims spanned 461 targeted organizations in more than 40 countries, with India being the most targeted country and IT services/managed service providers being the more impacted sector.“IT service providers are high-value targets because: (a) they manage client infrastructure – a single IT provider compromise can enable supply chain attacks against dozens of downstream clients, (b) IT staff often have privileged access to Azure AD, on-prem AD, RMM tools, and password managers,” CloudSEK researchers said.