Hackers Steal Microsoft 365 Sessions to Hijack Accounts Even After MFA

Cybercriminals are using a rebranded Evilginx2 phishing-as-a-service platform dubbed BigBear 2.0 to intercept authenticated Microsoft 365 sessions, allowing them to take over accounts even after victims complete multi-factor authentication (MFA).

CloudSEK’s TRIAD team uncovered the operation after gaining administrative access to its control panel in June 2026

The campaign demonstrates a critical reality for Microsoft 365 defenders: conventional MFA methods such as SMS codes, TOTP authenticators, push prompts, and voice calls can verify a user successfully but still fail to stop an adversary-in-the-middle (AiTM) proxy from stealing the session issued after authentication.

BigBear 2.0 is operated by an actor using the alias “General Boss” and is built as a multi-tenant phishing-as-a-service platform.

The panel managed 42 VPS nodes during the campaign lifecycle, largely hosted on Vultr infrastructure, with the Evilginx2-derived “offy” phishlet configured specifically to proxy Microsoft 365 authentication traffic.

Since late July, the operators have removed 26 observed nodes, indicating active infrastructure cleanup and counter-forensic activity.

The dataset included 1,032 plaintext passwords, 4,148 session cookies, and 474 complete authentications in which the victim had completed MFA before their session was hijacked.

India, France, Saudi Arabia, New Zealand, and Germany were among the countries most affected.

Unlike a conventional credential-harvesting page, BigBear 2.0 acts as a transparent reverse proxy between a victim and Microsoft’s legitimate sign-in service.

A victim who clicks a phishing link is served a Microsoft 365 login flow through an attacker-controlled domain, while the phishing server relays requests and responses to login.microsoftonline.com.

The victim enters their username and password, then approves a push notification or submits a one-time code. Microsoft validates the authentication event and returns an authenticated browser session.

At that stage, the AiTM server captures the Microsoft-issued session cookie before forwarding the response to the victim.

The attacker can then replay that cookie in a separate browser session and inherit the victim’s authenticated access without needing the password or MFA code again.

This can expose Exchange Online mailboxes, Teams, SharePoint Online, OneDrive, Entra ID resources, and SaaS applications federated through Microsoft identity.

CloudSEK found that, the platform had collected 5,137 credential records affecting 461 organizations and 3,331 unique victim IP addresses across more than 40 countries.

Microsoft 365 Sessions Hijacked

The technique does not break MFA cryptography. Instead, it abuses the trust placed in a session token after authentication succeeds.

That distinction matters: resetting a password alone may not evict an attacker who already possesses an active session or refresh token.

BigBear 2.0 used a geo-matched residential proxy pool spanning 69 countries.

By routing the upstream Microsoft connection through an IP address matching a victim’s geography, the platform can reduce the effectiveness of location-based anomaly detection and geo-blocking controls.

CloudSEK also identified at least five affiliate operators receiving stolen credentials and cookies through real-time Telegram notifications.

The architecture included centralized panel administration, VPS allocation by user, cookie replay automation, and live event logging features consistent with a commercial phishing-as-a-service operation rather than a one-off phishing kit.

Researchers observed custom JavaScript injected into proxied pages to interfere with FIDO2/WebAuthn flows, suppress selected Microsoft telemetry endpoints, and automatically select “Keep me signed in.”

The objective is to force victims toward weaker, phishable authentication options and maximize the useful lifetime of captured sessions.

FIDO2 security keys, passkeys, and Windows Hello for Business are structurally more resistant to AiTM phishing because their cryptographic assertions are bound to the website origin.

A credential registered for login.microsoftonline.com will not authenticate to an attacker-controlled phishing domain, even when that domain proxies traffic to Microsoft.

Organizations should prioritize phishing-resistant MFA for administrators, finance teams, IT service providers, privileged cloud users, and accounts with access to sensitive SharePoint, Exchange, or Azure resources.

Entra Conditional Access policies should also require compliant or managed devices where feasible, restrict legacy authentication, and enforce stronger authentication requirements for high-value applications.

For suspected BigBear-style compromise, defenders should revoke active sessions and refresh tokens, force reauthentication, reset credentials, review Entra sign-in activity, and investigate mailbox rules, OAuth consent grants, new MFA registrations, and anomalous administrative actions.

Reviewing only password reset events is insufficient because cookie replay may preserve access until the stolen session is explicitly invalidated.

The campaign underscores that MFA remains essential, but MFA alone is no longer an adequate defense against modern Microsoft 365 phishing operations.

The security boundary increasingly depends on phishing-resistant authentication, device trust, session controls, and rapid detection of suspicious post-authentication behavior.

IOCs

IP Address (Defanged)	Type
38[.]60[.]250[.]157	VPS Node
95[.]179[.]233[.]79	VPS Node
80[.]240[.]27[.]55	VPS Node
65[.]20[.]103[.]58	VPS Node
38[.]54[.]124[.]88	VPS Node
208[.]85[.]20[.]79	VPS Node
95[.]179[.]169[.]154	VPS Node
107[.]191[.]46[.]14	VPS Node

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.