BigBear 2.0: How Evilginx2 Phishing Bypasses Microsoft 365 MFA (And How to Detect It)

BigBear 2.0 is a phishing-as-a-service operation built on Evilginx2, an adversary-in-the-middle (AiTM) proxy framework. It doesn't crack MFA — it lets a victim complete MFA normally, then steals the session cookie Microsoft issues afterward. That cookie is enough to hijack the account, no password or OTP required again.

Security researchers reported the operation affected 460+ organizations across 40+ countries, with roughly 9% of captured sessions resulting in a full MFA bypass.

How the Attack Works

1. Victim clicks a phishing link routed through an attacker-controlled proxy.
2. The proxy relays real traffic to Microsoft's actual login page — so the page victims see is genuine.
3. Victim enters credentials and completes MFA as normal.
4. Microsoft issues an authenticated session cookie — the proxy silently captures a copy.
5. The attacker replays that cookie and steps directly into the live session (Outlook, Teams, SharePoint, connected SSO apps).

The kit reportedly also nudges victims away from FIDO2/WebAuthn key prompts toward weaker MFA fallbacks, and uses residential proxies to make attacker traffic look geographically consistent with the real user — undermining location-based Conditional Access.

Why Standard MFA Doesn't Catch This

From the identity provider's point of view, the login was legitimate. Detection has to shift from "did auth succeed" to "does this session's behavior make sense."

Watch for:

• Same session token used from geographically distant IPs in a short window
• Token reuse on a device/browser that never did the original interactive sign-in
• New mailbox forwarding rules created shortly after sign-in
• New OAuth app consent grants from unfamiliar networks

A starting hunt query for Microsoft Sentinel/Defender:

SigninLogs
| where ResultType == 0
| summarize IPs = make_set(IPAddress), Countries = make_set(LocationDetails.countryOrRegion) by UserPrincipalName, AppDisplayName, bin(TimeGenerated, 1h)
| where array_length(IPs) > 1 and array_length(Countries) > 1

Treat hits as investigation starting points, not confirmed compromise — VPNs and mobile IP rotation can trigger false positives.

How to Actually Defend Against It

• Phishing-resistant auth: FIDO2 keys / passkeys bind login cryptographically to the real domain — a proxied page can't replicate that.
• Conditional Access + device compliance: require managed devices for sensitive apps instead of trusting IP/location alone.
• Shorter token lifetimes + continuous access evaluation to shrink the usable window for a stolen cookie.
• EDR/UEBA tuned for identity signals — anomalous OAuth consent and mailbox-rule changes, not just malware.

If a session is confirmed or suspected hijacked: revoke all active sessions/refresh tokens, force re-auth, reset the password, and audit for new forwarding rules and OAuth grants before closing the incident.

FAQ

Is this a Microsoft 365 vulnerability? No — it abuses trust in an already-authenticated session, not a flaw in Microsoft's code.

Does MFA stop it? Standard OTP/push MFA does not, since the attacker lets it complete and steals the resulting session proof.

What does stop it? Phishing-resistant authentication (FIDO2/passkeys).

Full analysis and indicators of compromise: https://www.xpert4cyber.com/2026/09/bigbear-2-0-evilginx2-mfa-bypass.html