Researchers who got inside a criminal phishing panel found 4,148 stolen Microsoft 365 session cookies sitting in it, each one a working key to somebody's mailbox. Getting in also showed why so many of them worked. The operators had bolted code onto their fake login pages that quietly switches off hardware security keys.
CloudSEK's TRIAD team found the platform, which it calls BigBear 2.0, in June 2026 and obtained administrator access to it. In a report by researcher Gagan Aggarwal, the team says the operation was still live as it wrote, and had logged 5,137 credential records from 461 organizations in more than 40 countries.
Rented out to at least five operators
BigBear 2.0 is a rebadged build of Evilginx2, an open source proxy toolkit, sold as a service. An operator using the alias "General Boss" leases seats on it, and CloudSEK identified at least five affiliates by probing the Telegram bots that deliver each one their stolen logins in real time. The panel drove 42 rented servers over the campaign's life, nearly all at The Constant Company (Vultr). Since late July the operator has deleted 26 of them, which the researchers read as a reaction to being noticed.
The haul is 1,032 plaintext passwords, 4,148 session cookies and 474 complete sign-ins where multi-factor authentication was defeated end to end, across more than 3,300 victim IP addresses. India leads with 658 records, 12.8 percent of the total, ahead of France with 463 and Saudi Arabia with 353. IT service providers were the largest target group at 151 organizations, which matters more than the number suggests: one compromised provider opens the door to every client whose systems it administers.
A proxy that sits between you and Microsoft
The technique is adversary in the middle phishing. Rather than serve a counterfeit login form, the server relays the victim's traffic to Microsoft's real sign-in page and copies everything passing through, so the victim sees the genuine page and a valid padlock. Complete the MFA prompt, by app, push or text, and Microsoft issues the session cookie proving the check was done. The proxy takes a copy on the way past, and the attacker loads it into their own browser to arrive inside the mailbox with no prompt at all. We have covered the same trick sold as a subscription, and a Europol led operation dismantled one of the largest platforms of this kind.
Three lines of code that neuter a security key
What separates BigBear 2.0 from stock Evilginx2 is three JavaScript injections CloudSEK pulled off a live phishing page. The first sets the browser's PublicKeyCredential interface to undefined, so FIDO2 and WebAuthn appear unavailable and anyone holding a hardware key or using Windows Hello is pushed onto a weaker method the proxy can capture. The second drops any outbound request addressed to Microsoft's anti-phishing telemetry or to canary token services, so the page reports itself to nobody. The third ticks "Keep me signed in" for the victim.
The rest is built to keep researchers out as much as victims in. Traffic is routed onward to Microsoft through a residential address in the victim's own country, from a pool covering 69 countries, so the sign-in looks local and location based access rules are satisfied. Anyone arriving from a data centre, VPN or proxy address is screened out before the page loads.
Selected indicators. Nodes named in the report include 208[.]85[.]20[.]79 (soil-management[.]com), 130[.]94[.]113[.]184 (konceptenterprises[.]com), 78[.]141[.]193[.]59 (annastudios-paros[.]com) and 70[.]34[.]208[.]46 (cifutura[.]com). Each issues its own Let's Encrypt certificate for a lookalike subdomain, so the padlock proves nothing.
Remove the fallbacks, do not just switch MFA on
FIDO2 is the one method this attack cannot beat, because the cryptographic answer is tied to the domain that asked the question and the phishing domain is not Microsoft's. That is precisely why the first injection exists. An attacker who can make the key look absent still wins if a weaker method is permitted, so enforce phishing resistant sign-in and remove the fallbacks rather than keep them for convenience. When an account is burned, revoke its sessions and refresh tokens, not only the password. A stolen cookie does not care that the password changed.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.