BigBear phishing crew nets thousands of Microsoft 365 credentials

BigBear phishing crew harvested thousands of Microsoft 365 credentials and session cookies across hundreds of organizations. The operation, using Evilginx2-based phishing-as-a-service, captured hundreds of authenticated sessions capable of bypassing MFA. Researchers gained access to the attackers' admin panel, revealing unprecedented campaign details.

https://www.theregister.com/security/2026/09/08/bigbear-phishing-crew-nets-thousands-of-microsoft-365-credentials/5294944