CloudSEK Details BigBear 2.0 Evilginx2 Campaign That Hijacked Microsoft 365 Sessions

Sep 7, 2026 · Original article ↗

Summary

CloudSEK says BigBear 2.0 stole 5,137 Microsoft 365 credential records, including 474 MFA-bypassed sessions, using Evilginx2, residential proxies, and Telegram exfiltration. The report includes infrastructure indicators and mitigation advice.

Key points

CloudSEK reports that BigBear 2.0 is an Evilginx2-based phishing-as-a-service operation targeting Microsoft 365.
The panel recorded 5,137 credential records across 461 organizations and 3,331 victim IPs; the report lists 474 complete MFA-bypassed authentications.
The AiTM proxy captures credentials and session cookies as victims authenticate, then enables attackers to replay sessions.
The operation used geo-matched residential proxies and custom JavaScript that disabled FIDO2/WebAuthn options and blocked some Microsoft telemetry.
Stolen credentials were sent to Telegram bots for at least five affiliate operators; CloudSEK observed a 42-node VPS infrastructure during the campaign.
The report says the campaign was active at the time of writing and that 26 observed VPS nodes had been removed from the panel since late July 2026.
Recommended responses include resetting affected passwords, revoking session and refresh tokens, requiring re-authentication, and using phishing-resistant FIDO2/WebAuthn MFA.

Article Details

Attack Vectors: Phishing links delivered by email direct victims to Evilginx2-based reverse proxies that relay Microsoft 365 authentication and capture credentials and session cookies.
Captured session cookies are replayed to access victim accounts after MFA completion; the panel also automates cookie replay and refresh-token keepalive.
Custom JavaScript injections disable FIDO2/WebAuthn and block selected Microsoft anti-phishing telemetry requests on proxied login pages.
Geo-matched residential proxies make phishing-session traffic appear to originate from the victim's country and help evade location-based detection.
Stolen credentials and session data are sent to operators through Telegram bots.
Defensive Notes: Reset affected passwords, revoke session and refresh tokens, and force user re-authentication.
Enable phishing-resistant MFA such as FIDO2 or WebAuthn.
Enforce Conditional Access and require compliant devices.
Use the article's listed Evilginx/BigBear session-cookie and custom-header indicators for detection.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`annastudios-paros[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`arrmmy[.]com`	Historical phishing domain listed among the campaign's indicators.
DOMAIN	`captelind[.]com`	Historical phishing domain listed among the campaign's indicators.
DOMAIN	`ccpipharma[.]com`	Phishing domain listed among the campaign's indicators.
DOMAIN	`cifutura[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`daengrentacar[.]com`	Historical phishing domain; the article also identifies a phishing page on this domain.
DOMAIN	`dataclust[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`dnsforward[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`dronalms[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`haliotisbar[.]com`	Historical phishing domain listed among the campaign's indicators.
DOMAIN	`hnospascualfadon[.]com`	Historical phishing domain listed among the campaign's indicators.
DOMAIN	`hoaivt[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`hotelmidtownsurat[.]com`	Phishing domain listed among the campaign's indicators.
DOMAIN	`kgsscans[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`knowncontractor[.]com`	Historical phishing domain listed among the campaign's indicators.
DOMAIN	`konceptenterprises[.]com`	Phishing domain listed among the campaign's indicators.
DOMAIN	`management[.]michaelmarcotte[.]com`	Phishing domain listed among the campaign's indicators.
DOMAIN	`offtic[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`planisteradmin[.]com`	Historical phishing domain listed among the campaign's indicators.
DOMAIN	`rootreseller[.]com`	Phishing domain listed among the campaign's indicators.
DOMAIN	`soil-management[.]com`	Phishing domain assigned to an affiliate operator.
DOMAIN	`valtteri[.]net`	Historical phishing domain listed among the campaign's indicators.
DOMAIN	`virextec[.]com`	Phishing domain listed among the campaign's indicators.
HOSTNAME	`login[.]konceptenterprises[.]com`	Example phishing subdomain used in the article's phishlet configuration.
IPV4	`107[.]191[.]46[.]14`	Attacker VPS node listed in the article's indicators.
IPV4	`130[.]94[.]113[.]184`	Historical attacker VPS node assigned to an affiliate operator.
IPV4	`130[.]94[.]82[.]180`	Attacker VPS node assigned to an affiliate operator.
IPV4	`130[.]94[.]82[.]230`	Attacker VPS node assigned to an affiliate operator.
IPV4	`136[.]244[.]114[.]85`	Historical attacker VPS node listed in the article's indicators.
IPV4	`152[.]39[.]137[.]60`	Historical attacker VPS node listed in the article's indicators.
IPV4	`199[.]247[.]10[.]14`	Historical attacker VPS node listed in the article's indicators.
IPV4	`208[.]76[.]222[.]214`	Attacker VPS node listed in the article's indicators.
IPV4	`208[.]85[.]18[.]18`	Attacker VPS node assigned to an affiliate operator.
IPV4	`208[.]85[.]20[.]79`	Attacker VPS node assigned to an affiliate operator.
IPV4	`38[.]54[.]124[.]58`	Attacker VPS node assigned to an affiliate operator.
IPV4	`38[.]54[.]124[.]88`	Attacker VPS node listed in the article's indicators.
IPV4	`38[.]60[.]250[.]157`	Attacker VPS node listed in the article's indicators.
IPV4	`45[.]32[.]147[.]239`	Attacker VPS node assigned to an affiliate operator.
IPV4	`45[.]32[.]64[.]165`	Historical attacker VPS node listed in the article's indicators.
IPV4	`64[.]176[.]72[.]180`	Historical attacker VPS node listed in the article's indicators.
IPV4	`65[.]20[.]102[.]80`	Attacker VPS node listed in the article's indicators.
IPV4	`65[.]20[.]103[.]58`	Attacker VPS node listed in the article's indicators.
IPV4	`70[.]34[.]208[.]46`	Historical attacker VPS node assigned to an affiliate operator.
IPV4	`70[.]34[.]244[.]122`	Historical attacker VPS node listed in the article's indicators.
IPV4	`78[.]141[.]193[.]59`	Historical attacker VPS node assigned to an affiliate operator.
IPV4	`80[.]240[.]27[.]55`	Attacker VPS node listed in the article's indicators.
IPV4	`91[.]245[.]235[.]208`	Historical attacker VPS node listed in the article's indicators.
IPV4	`95[.]179[.]169[.]154`	Attacker VPS node assigned to an affiliate operator.
IPV4	`95[.]179[.]233[.]79`	Attacker VPS node listed in the article's indicators.