BigBear phishing stole 5,137 Microsoft 365 credentials

CloudSEK accessed the admin panel of BigBear 2.0, an Evilginx2-based phishing operation targeting Microsoft 365. The panel held 5,137 records from 461 organizations, including 4,148 session cookies and 474 complete MFA-bypassed authentications. The operation remained active, using a template called "offy" and residential proxies across 69 countries.