Rupert Marais joins us to break down the mechanics of the BigBear 2.0 operation, a sophisticated Phishing-as-a-Service campaign that has compromised thousands of accounts. With his deep background in device security and network management, he sheds light on how threat actors are now bypassing traditional defenses with industrial-scale efficiency. Our conversation explores the automation of session hijacking, the strategic targeting of managed service providers, and the urgent need for a shift toward phishing-resistant authentication frameworks to combat these evolving adversaries.
The BigBear 2.0 operation utilizes the Evilginx2 framework to facilitate adversary-in-the-middle attacks. How does this specific framework enable the automated capture of session cookies, and what technical steps should a security team take to identify if an active session has been hijacked?
Evilginx2 acts as a transparent reverse proxy, sitting right between the victim and the legitimate Microsoft 365 login page to capture data in real-time. Because it intercepts the communication as it happens, it can steal the session cookies issued after a successful MFA challenge, which resulted in 4,148 session cookies being exfiltrated in this specific campaign. To identify a hijack, security teams must audit sign-in logs for anomalies, specifically looking for sessions originating from unexpected hosting providers like Vultr, which hosted 42 nodes for this operation. You should also be on the lookout for “impossible travel” alerts where a session cookie used in one region suddenly appears in another, especially given that this campaign impacted victims across more than 40 countries.
Threat actors are increasingly using residential proxy pools and automated Telegram exfiltration to bypass geographic restrictions and traditional security alerts. How do these tools help attackers evade detection during the credential exfiltration process, and what metrics can organizations monitor to spot this type of sophisticated traffic?
By utilizing residential proxy pools, the attacker, known as “General Boss,” makes malicious traffic appear as if it is coming from a standard home internet connection rather than a flagged data center. This geo-matching tactic is incredibly effective at bypassing basic location-based blocking that many companies rely on for their perimeter security. Organizations need to monitor for unusual outbound traffic patterns, specifically spikes in communication with Telegram API endpoints which the five identified affiliates use to receive stolen data. We observed 3,331 unique victim IPs involved, so tracking multiple authentication attempts from disparate residential IP ranges that do not align with employee home locations is a critical metric for detection.
While over 5,000 credential records have been exposed, the targeting of IT service providers suggests a broader strategy for supply chain infiltration. Why are managed service providers considered such high-value targets, and what are the specific dangers of an attacker gaining privileged access to RMM tools or Entra ID?
Managed service providers are the ultimate “keys to the kingdom” because they hold the administrative access required to manage the infrastructure of dozens of downstream clients. In this campaign, 461 organizations were compromised, with IT providers being the primary target because a single breach here allows for a massive supply chain attack. Gaining access to RMM tools or Entra ID means the threat actor can move laterally with legitimate administrative credentials, often bypassing standard alarms entirely. This level of access provides a foundation for everything from financial fraud and data theft to the total compromise of additional enterprise systems through privileged account manipulation.
The transition from standard phishing to phishing-as-a-service (PhaaS) has allowed affiliates to bypass multi-factor authentication (MFA) at scale. Can you walk through the “cookie-replay” process that allows an unauthorized user to maintain persistent access, and how does this complicate the standard incident response timeline?
The cookie-replay process is a highly automated system where stolen session information is fed directly from the phishing page into a system that mimics a logged-in browser state. This allowed the BigBear 2.0 operators to successfully complete 474 MFA-bypassed authentications, effectively rendering the second factor of authentication useless. From an incident response perspective, this is a nightmare because the breach does not look like a suspicious login attempt; it appears as a legitimate, already-authenticated user returning to their session. This forces responders to expand their timeline, moving beyond simple password resets to a comprehensive audit and revocation of every active session and refresh token associated with the account.
Organizations are often advised to move toward phishing-resistant authentication methods like FIDO2 or WebAuthn to mitigate these risks. What are the primary hurdles companies face when implementing these hardware-backed standards, and what conditional access policies provide the best interim protection for sensitive SaaS environments?
The most significant hurdle is often the logistical friction of distributing physical security keys to a global workforce, especially in a campaign hitting regions as diverse as India, France, and Saudi Arabia. There is also the persistent challenge of legacy applications that do not yet support modern protocols like WebAuthn, creating gaps in the security posture. In the interim, the most effective protection involves strengthening conditional access policies to require that devices be “compliant” or “company-managed” before they can access sensitive SaaS applications. This ensures that even if a session cookie is stolen, it cannot be easily replayed from an unauthorized or unmanaged device used by the attacker.
With session cookies granting access to everything from SharePoint to OneDrive, a single compromise can lead to significant data theft or financial fraud. How should an organization prioritize the revocation of refresh tokens during a mass breach, and what evidence is required to confirm that a threat actor has been fully evicted?
Revocation must be prioritized for accounts with privileged roles, such as Global Admins, because these accounts have the widest reach into SharePoint, OneDrive, and Teams. With 1,032 plaintext passwords exposed alongside the cookies, a simple password change is insufficient; you must force a global re-authentication and terminate all existing refresh tokens. To confirm full eviction, security teams need to see a clean log history showing no further activity from the 42 VPS nodes used in the campaign, specifically those configured with the “offy” phishlet. It is also vital to verify that no new mail-forwarding rules or third-party API integrations were established during the window of compromise to ensure no backdoors remain.
What is your forecast for the evolution of phishing-as-a-service operations?
I expect PhaaS operations to become increasingly modular, with attackers integrating artificial intelligence to customize phishing lures in real-time based on the specific victim’s industry or role. From 2026 to 2028, we will likely see these platforms offering automated lateral movement and data exfiltration as built-in features, moving beyond just stealing credentials to providing a full “breach-in-a-box” service. As long as organizations continue to rely on session-based cookies that can be replayed, these service providers will refine their automation until phishing-resistant hardware becomes a universal requirement for any secure business environment.
