Microsoft 365 Users Hit by Sophisticated Phishing Campaigns Using BigBear 2.0

Microsoft 365 users are being targeted by sophisticated cyberattacks using phishing campaigns and fake IT calls. The attackers aim to steal credentials, which can be used in data theft attacks.

The campaigns use BigBear 2.0, a new phishing-as-a-service (PhaaS) framework that allows hackers to intercept passwords and authenticated session cookies. CloudSEK tracked over 5,000 stolen records, including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies.

The attackers impersonate IT staff via calls, Teams, and email, convincing victims to grant remote access or enter their credentials on a spoofed Microsoft 365 login page. The goal is to bypass multi-factor authentication (MFA) protection and gain access to victim accounts.

Arctic Wolf urges organizations to implement Conditional Access policies, deploy phishing-resistant MFA, and restrict data access via SharePoint. Employee education on the dangers of phishing is also crucial in preventing these attacks.