A phishing toolkit called BigBear 2.0 was sold to criminals as a subscription service and used to steal more than 5,000 Microsoft 365 login credentials from at least 258 organisations. The detail that matters most: it was specifically built to get around multi-factor authentication — the extra login step most people rely on to keep their accounts safe.
What happened
BigBear 2.0 is what security researchers call a phishing-as-a-service toolkit. Think of it like renting software. Instead of building their own attack tools, criminals paid for access and pointed the kit at targets. No specialist knowledge required.
The toolkit sat between victims and the real Microsoft 365 login page, capturing passwords and MFA codes in real time as people typed them in. By the time you finished logging in, the attacker already had everything they needed.
More than 5,000 credentials were stolen across at least 258 organisations. How long the campaign ran, which industries were targeted, and how the toolkit was discovered have not been disclosed.
Who is affected
If you use Microsoft 365 at work — that covers Outlook email, Teams, OneDrive, and the Office apps — and your employer is one of the affected organisations, your account could have been taken over without any visible sign.
Because BigBear 2.0 was rented out to multiple criminal groups, the range of targeted organisations is likely wide. This was not a single focused attack on one industry. It was a tool available to anyone willing to pay for it.
People who had MFA switched on are not automatically safe. The whole point of this toolkit was to defeat that protection. If you have been thinking of MFA as a near-perfect lock, this incident is a reason to adjust that view.
Family members can be caught up indirectly. A compromised work account often contains personal contacts, shared files, and private conversations. Those become accessible to whoever took over the account.
What the real risk is
Losing a Microsoft 365 login is not just about losing access to email. Whoever holds those credentials can read your messages, send emails pretending to be you, access shared documents, and potentially get into other systems connected to the same login.
The MFA bypass is the most significant part of this story. MFA — multi-factor authentication — is the system where logging in requires both your password and a second check, like a code sent to your phone. It raises the bar for attackers considerably. But this case shows it does not make an account untouchable.
Stolen credentials are frequently sold or reused. Even if nothing has gone wrong yet, credentials gathered in a campaign like this can reappear in attacks many months later.
If your employer has not told you your account was affected, that is not necessarily reassurance. Investigations take time, and disclosure timelines vary.
What to do today
These are specific steps you can take this week, not general advice.
- Change your Microsoft 365 password now. Go to account.microsoft.com, sign in, and update your password. Use something you have never used anywhere else — a random string of words works well.
- Check your recent sign-in activity. In Microsoft 365, go to mysignins.microsoft.com. You will see a list of recent logins with locations and devices. If anything looks unfamiliar — a city you have not visited, a device you do not own — report it to your IT department immediately.
- Switch to an authenticator app if you have not already. Text-message codes (SMS) are easier for attackers to intercept than codes generated by an app like Microsoft Authenticator or Google Authenticator. If your organisation allows it, make the switch. Ask your IT team how.
- Do not click login links in emails. If you get an email saying your Microsoft account needs attention, do not click the link. Type the address directly into your browser: office.com or account.microsoft.com. A convincing-looking email is exactly how this phishing attack starts.
- Tell your household. If anyone else in your home uses a work account — on a shared computer or their own device — show them this list. The most common weak point in any organisation’s security is someone who simply did not know the risk existed.
Why this keeps happening
Phishing-as-a-service has turned sophisticated attacks into a subscription product. The technical skill needed to run a campaign like this used to be a real barrier. Now it is not. Anyone who can pay a fee and follow instructions can deploy a toolkit that bypasses MFA and harvests credentials at scale.
MFA was designed to make a stolen password useless on its own. Attackers responded by building tools that relay your login to the real site in real time, capturing both your password and your MFA code before you even suspect anything. The attack adapts to the defence, not the other way around.
Microsoft 365 is a concentrated target because so many organisations depend on it for almost everything they do. When one platform holds the email, files, and communications of millions of workers, criminals build specific tools aimed at that platform.
There is a deeper problem underneath all of this. Online systems have no reliable way to confirm that the person logging in is actually who they say they are. When an attacker relays your credentials in real time, the system sees a valid password and a valid MFA code — it has no way to know a criminal is in the middle. The response to incidents like this one is almost always to chase attackers after the damage is done. The underlying gap — that there is no dependable link between a login and a real, accountable person — remains open. Until that changes, the pattern of attack, patch, new attack will continue.
Frequently asked questions
If I have MFA turned on, is my account still at risk?
Yes. BigBear 2.0 was specifically designed to defeat MFA. It works by placing a fake login page between you and the real Microsoft site. When you enter your password and MFA code, the toolkit passes them to the real site instantly, completing the login on the attacker’s behalf. Your MFA code is captured before it expires. MFA still reduces your overall risk, but it is not a complete guarantee.
How would I know if my Microsoft 365 account was accessed by someone else?
Go to mysignins.microsoft.com while signed in. This page shows every recent login to your account, including the location and device type. Look for anything you do not recognise. You can also check whether any inbox rules have been added that you did not create — attackers sometimes set these up to forward your email silently. If you find anything unusual, contact your IT team before changing settings yourself.
What makes phishing-as-a-service more dangerous than ordinary phishing?
Ordinary phishing requires the attacker to build their own fake pages, infrastructure, and delivery systems. Phishing-as-a-service means all of that is already built and available to rent. This means many different criminal groups can run campaigns at the same time, targeting different organisations, without needing technical expertise. The result is a much higher volume of attacks and a wider range of targets than any single attacker could manage alone.
Related reading
- Remote Monitoring Tool Flaw: What Managed IT Users Should Know
- Tax Data Stolen by a Hacker: What It Means for You
Originally reported by bleepingcomputer.com. This article summarises that reporting and adds practical guidance.
Mafiology tracks the tactics behind these schemes so you can recognise them early. Get our fraud-pattern alerts, plus a free copy of Wes Kussmaul’s Escape the Plantation on how scammers attack you and your family, and what can be done to stop them.
