In addition, this guide explains Microsoft 365 Security with practical details and clear takeaways. Phishing attacks have evolved far beyond stolen passwords. A recent campaign known as BigBear 2.0 shows how attackers can capture Microsoft 365 session cookies after a user completes multifactor authentication (MFA). They can then reuse that session without the password or second factor.

As a result, For a broader look at related threats, see this Microsoft 365 Security update. For an external reference, review the Computerworld report on the BigBear 2.0 campaign.

Microsoft 365 Security and why MFA Alone Is No Longer Enough

However, For enterprises, this is a serious reminder that authenticating a user is not the same as securing the session. Once an attacker gets an active session token, they may move through email, files, chats, and connected apps as if they were the real user. That changes how organizations must think about identity security, incident response, and phishing defense.

Microsoft 365 Security and what BigBear 2.0 Is and Why It Matters

For example, BigBear 2.0 is a phishing-as-a-service operation built to target Microsoft 365 users at scale. According to cybersecurity researchers, the service has harvested thousands of credentials and session cookies across hundreds of organizations in more than 40 countries.

What makes the campaign notable is not just its scale, but its method. The attackers do not simply try to capture usernames and passwords. Instead, they focus on the authenticated session created after MFA succeeds. That session can then be replayed to bypass the normal sign-in process.

For business leaders and IT teams, this matters because the old idea that “MFA means the account is safe” no longer holds up on its own. If the session itself is stolen, MFA may already be irrelevant.

Microsoft 365 Security and how the Attack Works

Microsoft 365 Security and reverse Proxy Phishing Flow

Meanwhile, BigBear 2.0 uses techniques linked to adversary-in-the-middle (AiTM) phishing, often implemented through tools like Evilginx2. In this setup, the attacker places a malicious reverse proxy between the victim and the real Microsoft authentication service.

Overall, Here is the basic flow:

• The victim opens a phishing link.
• The fake page forwards the login to Microsoft’s real sign-in service.
• The user enters credentials and completes MFA normally.
• Microsoft issues a valid authenticated session cookie.
• The phishing infrastructure intercepts that cookie.
• The attacker reuses the session to access Microsoft 365 without repeating the login.

This method is effective because the victim sees a normal sign-in process. From their perspective, everything looks legitimate. Behind the scenes, however, the attacker is capturing the session material needed to take over the account.

Microsoft 365 Security and residential Proxies Help Traffic Blend In

CloudSEK reported that the operation also uses residential proxies chosen to match the victim’s country. This matters because many security tools and Conditional Access policies rely on location-based signals to spot suspicious logins.

In addition, If malicious traffic appears to come from the same region as the user, it may look less suspicious to security controls. That makes it harder for defenders to distinguish a real sign-in from a hijacked one.

Microsoft 365 Security and weakening Strong Authentication Options

Researchers also found code designed to disable FIDO2/WebAuthn options on the phishing pages. In practice, that could push users toward easier-to-abuse methods such as OTP, SMS, or push-based MFA.

As a result, that is a major concern for organizations that have not fully standardized on phishing-resistant authentication. If secure methods exist only as optional choices, attackers may steer users toward weaker alternatives.

Microsoft 365 Security and what the Research Revealed

However, the administrative panel linked to the BigBear 2.0 operation contained more than 5,000 credential records, along with thousands of session cookies and over a thousand plaintext passwords. Researchers also identified records showing that attackers successfully captured authenticated sessions after MFA.

For example, the campaign affected organizations across many countries, with a particularly high number of targets in IT services and managed service provider environments. That is not surprising. Providers and service firms often have access to multiple customer environments, administrative consoles, and privileged workflows, making them high-value targets.

Meanwhile, For enterprise security teams, this creates a clear warning: attackers are not just trying to compromise one mailbox. They are often looking for a path into broader systems, partners, and downstream customers.

Why MFA Alone Is Not Enough

MFA remains an important security control, but BigBear 2.0 shows its limits when it is used without stronger session protection.

The Problem Is the Session, Not Just the Login

Overall, Many security strategies focus on the authentication event. But once the login succeeds, the resulting session cookie or token becomes the real prize.

In addition, that means organizations need to treat session cookies, access tokens, and refresh tokens as sensitive authentication assets, not invisible technical details. If stolen, they can keep unauthorized access alive long after the original sign-in.

Traditional MFA Methods Can Be Phished

As a result, OTP codes, SMS verification, and push approvals all have value. However, they are not enough against AiTM phishing. An attacker can relay the login in real time and capture the resulting authenticated session.

However, that is why security experts increasingly recommend phishing-resistant authentication such as:

• FIDO2/WebAuthn passkeys
• Windows Hello for Business
• Certificate-based authentication

The key point is not to offer these methods as optional extras while leaving weaker methods in place by default. Enterprises should enforce stronger authentication through policy wherever possible.

What Enterprises Should Do Now

Enforce Phishing-Resistant Authentication

For example, the most effective long-term defense is to move away from authentication methods that can be proxied or relayed. Organizations using Microsoft 365 should prioritize FIDO2/WebAuthn passkeys and enforce them for users with elevated privileges.

In addition, teams should review whether Conditional Access policies truly require the strongest method or merely allow it as one option among weaker ones.

Strengthen Session Controls

Meanwhile, Security teams should look beyond password resets and MFA prompts. A stolen session should be handled as an active compromise, not just a credential issue.

Overall, Incident response actions may include:

• Disabling or isolating the affected account
• Revoking Entra sign-in sessions
• Revoking refresh tokens
• Forcing reauthentication
• Reviewing all recent Microsoft 365 activity

This includes checking for:

• Mailbox access
• Malicious inbox rules
• Suspicious OAuth consent grants
• Newly registered MFA devices
• Privilege escalation
• Access to other cloud applications

Use Continuous Access Evaluation and Token Protection

In addition, Where supported, Continuous Access Evaluation can help reduce the window of exposure by reacting more quickly to changes in user risk or session status. Token protection can also add value, although coverage may vary across devices, clients, and workloads.

These controls help, but they are not a complete fix. They should be part of a layered identity security strategy rather than a standalone answer.

Improve Detection and Logging Integration

As a result, One practical challenge highlighted by this campaign is operational visibility. Identity telemetry is not always tightly integrated with SIEM and SOC workflows.

However, that gap matters. If identity signals are isolated from the analysts who investigate suspicious activity, attackers can stay hidden longer. Security teams should make sure sign-in logs, identity events, and cloud application logs are visible in a shared investigation workflow.

Incident Response Must Focus on Session Reconstruction

When an authenticated session is stolen, the key question is not only “How did the attacker get in?” but also “What did they do while inside?”

IP address checks may be misleading because residential proxies can make malicious activity look geographically normal. Instead, responders should reconstruct the attacker’s actions inside the session.

That investigation should include:

• Email sent or deleted
• New forwarding or inbox rules
• Access to sensitive files
• OAuth app approvals
• Changes to security settings
• Access to collaboration platforms or connected SaaS tools

Organizations should also assess whether the compromised account was used to contact employees, customers, or partners. A stolen Microsoft 365 session can become a launch point for wider social engineering and business email compromise.

Why This Threat Is a Business Problem

For example, Campaigns like BigBear 2.0 affect more than technical teams. They can disrupt operations, expose sensitive communication, and create legal or compliance risk. In managed service and IT services environments, the impact can grow quickly because one compromised account may open the door to several client environments.

Meanwhile, that is why executives and business owners should view session hijacking as part of identity risk management, not just phishing protection. The cost of a compromise is often driven by response time, privilege exposure, and how much access the attacker reaches before detection.

Preparing for the Next Wave of Identity Attacks

Overall, the larger lesson from BigBear 2.0 is clear: attackers are industrializing session theft. They are packaging advanced phishing methods into services that require less expertise and can be deployed at scale.

In addition, Enterprises should respond by modernizing identity security across three areas:

1. Authentication – enforce phishing-resistant methods
2. Session security – revoke and monitor tokens aggressively
3. Operational readiness – test session hijacking in tabletop exercises

Including session theft in incident simulations is especially useful. It helps identity, SOC, messaging, and cloud teams practice how they would respond when MFA has already been bypassed and the attacker is operating inside a valid session.

Conclusion

As a result, BigBear 2.0 is a clear example of how phishing has moved beyond passwords and into session theft. For Microsoft 365 customers, the lesson is simple: MFA is essential, but it is not enough by itself. Organizations need phishing-resistant authentication, stronger token and session controls, and incident response plans designed for authenticated-session compromise.

The companies that adapt fastest will be better positioned to protect users, preserve trust, and limit the business impact of modern identity attacks.

FAQ

What is BigBear 2.0?

BigBear 2.0 is a phishing-as-a-service operation that targets Microsoft 365 users and steals authenticated session cookies after MFA is completed.

Can MFA be bypassed in Microsoft 365 attacks?

Yes. In AiTM phishing attacks, attackers can relay the login in real time, capture the session cookie, and reuse it even after the user completes MFA.

What is the best defense against session hijacking?

The strongest defense is phishing-resistant authentication such as FIDO2/WebAuthn passkeys, combined with session revocation, token controls, and strong monitoring in Microsoft 365.