Across 258 organizations, a criminal operation known as BigBear has demonstrated that the most sophisticated lock can be opened by a convincing voice on the telephone. By impersonating IT support and guiding corporate executives through fabricated security procedures, attackers are harvesting Microsoft 365 credentials and bypassing multi-factor authentication — the very safeguard designed to make stolen passwords meaningless. This campaign reminds us that trust, not technology, remains the most exploitable vulnerability in any organization, and that the human instinct to cooperate with authori
Sophisticated phishing campaign targets Microsoft 365 users with fake IT calls and MFA bypass
They sound legitimate because they know enough to be credible
Mark
So these attackers are just calling people up and asking for passwords? That seems almost too simple.
Mimi
It is simple, but it works because they're not calling randomly. They're targeting specific executives, and they sound like they know what they're talking about. They create a scenario that feels urgent and legitimate.
Luke
Do we know how they're getting the phone numbers and knowing who to call? The reporting says they're targeting executives, but I want to know if they're using public information or if they've already compromised something to get that intel.
Mimi
That's a good question. The reporting confirms the calls are happening and that 258 organizations have been breached, but it doesn't detail the reconnaissance phase. We know the outcome; the method of targeting is less clear.
Mark
And the MFA bypass—how does that actually work? I thought MFA was supposed to stop this.
Mimi
They're using a tool called Evilginx2, which sits between the victim and Microsoft's servers. It captures the credentials and the session token in real time, so the attacker gets in as if they were the legitimate user.
Luke
But that requires the victim to enter their credentials into a fake login page during the call, right? So the victim has to be convinced to do that. How often is that actually working?
Mimi
We know it worked 258 times. Whether that's out of hundreds of attempts or thousands, we don't know. The reporting confirms the success rate is high enough to be a serious threat.
Mark
What happens after they get in? Do they just steal everything at once?
Mimi
No, they establish access and then move laterally through the organization, accessing shared drives, other accounts, anything they can reach. Then they threaten to publish the data unless the company pays.
Luke
So this is extortion, not just data theft. Do we have numbers on how much they're demanding or how many organizations have actually paid?
Mimi
The reporting doesn't include those details. We know the extortion is happening, but the financial impact isn't quantified in what's been published so far.
Mark
What's the defense here? Can you really stop someone from being socially engineered on a phone call?
Mimi
You can make it harder. Require verification callbacks to known numbers, implement approval workflows for sensitive actions, monitor for unusual logins. But you're right—it's fundamentally a people problem, not just a technical one.
O Pulso
- A criminal phishing service called BigBear has successfully breached 258 organizations by combining targeted phone calls with advanced credential-harvesting tools that defeat multi-factor authentication.
- Attackers impersonate IT support with enough technical fluency to sound legitimate, creating real-time urgency that pressures executives into surrendering login credentials during the call itself.
- The underlying tool, built on the Evilginx2 framework, doesn't just steal passwords — it captures authenticated session tokens, allowing attackers to log in as the victim with all security layers already cleared.
- Once inside, attackers move laterally through email, shared files, and connected systems before pivoting to extortion, threatening to publish stolen data unless the organization pays.
- Security teams are urging organizations to add verification layers for IT support requests and monitor for anomalous login activity, but acknowledge that a fundamentally social attack resists purely technical countermeasures.
Across 258 organizations, a criminal operation known as BigBear has demonstrated that the most sophisticated lock can be opened by a convincing voice on the telephone. By impersonating IT support and guiding corporate executives through fabricated security procedures, attackers are harvesting Microsoft 365 credentials and bypassing multi-factor authentication — the very safeguard designed to make stolen passwords meaningless. This campaign reminds us that trust, not technology, remains the most exploitable vulnerability in any organization, and that the human instinct to cooperate with authority is older and more powerful than any security protocol.
Someone calls an executive, identifies themselves as IT support, and walks them through what sounds like a routine security check. By the end of the call, the attacker has their Microsoft 365 credentials — and has already bypassed multi-factor authentication. This is not a hypothetical scenario. A phishing operation called BigBear has used exactly this method to compromise 258 organizations, blending old-fashioned social engineering with technically sophisticated credential-harvesting infrastructure.
What makes BigBear dangerous is the combination. The phone call exploits human trust in ways that mass phishing emails cannot — an attacker can answer questions, adjust their story, and manufacture urgency in real time. Meanwhile, the technical layer, built on an open-source framework called Evilginx2, intercepts not just passwords but authenticated session tokens, meaning the attacker inherits a fully verified login session. The second lock, the one that was supposed to make a stolen password useless, is already open.
Once inside a compromised account, attackers can read emails, access shared files, trace strategic plans through calendar invitations, and pivot toward other accounts and systems. The endgame is typically extortion: pay, or the stolen data becomes public. The targets are not random — executives and administrators are chosen precisely because their accounts carry broad access, and the attackers invest enough reconnaissance to sound credible before ever dialing.
Defenders are left navigating an uncomfortable truth: there is no patch for a convincing phone call. Organizations are advised to require independent verification for any IT support request, monitor logins for unusual patterns, and build approval workflows around sensitive administrative actions. But awareness and skepticism — the real defenses — are difficult to scale, and the attack is, at its core, a social problem that technology alone cannot solve.
Attackers are calling corporate executives claiming to be from IT support, walking them through what sounds like a routine security check, and by the end of the call, have their Microsoft 365 credentials. The twist: they're also getting past multi-factor authentication, the security layer that's supposed to stop exactly this kind of breach. This isn't theoretical. A phishing operation called BigBear has successfully compromised 258 organizations using this method, combining old-school social engineering—the phone call—with sophisticated credential-harvesting tools to steal access to email, files, and internal communications.
The attack works because it exploits trust. An executive receives a call from someone who sounds professional, knows enough technical details to seem legitimate, and creates a sense of urgency around a security issue. The caller walks the target through steps that appear to be standard verification procedures. In reality, the victim is entering credentials into a fake login page or revealing the information directly. What makes BigBear different from run-of-the-mill phishing is that it defeats multi-factor authentication—the second lock that should require a separate code or approval from a trusted device, even if a password is compromised.
The tool behind this campaign is built on Evilginx2, an open-source framework designed specifically to intercept and bypass MFA protections. Evilginx2 works by creating a proxy between the victim and the legitimate Microsoft login servers, capturing credentials and session tokens in real time. This means the attacker doesn't just get a password; they get the authenticated session itself, which allows them to log in as if they were the victim, MFA and all. The BigBear 2.0 variant has been refined to make this process seamless and reliable across multiple targets.
Once inside a compromised account, attackers have access to everything that account holder can see: emails containing sensitive business information, shared files, calendar invitations that reveal strategic plans, and often links to other systems and resources. From there, the breach spreads. Attackers can pivot to other accounts, access shared drives, and establish persistence—ways to maintain access even if the initial compromise is discovered. The endgame is typically extortion: the attackers threaten to publish stolen data or disrupt operations unless the organization pays.
The fact that 258 organizations have been successfully breached suggests this isn't a small operation or a proof-of-concept. This is a working criminal enterprise at scale. The targets appear to be high-value: executives and administrators whose accounts grant broad access. The attackers are selective and patient, which is why the phone call approach works. They're not blasting out mass emails hoping someone clicks; they're making targeted calls to specific people, often with enough reconnaissance to sound credible.
What makes this campaign particularly difficult to defend against is that it combines multiple attack surfaces. There's no single technical fix. You can't just patch your way out of someone calling an executive and convincing them to log in. The phone call feels personal and immediate in a way an email doesn't. The attacker can respond to questions, adjust their story, and create pressure in real time. And once they have credentials, the technical sophistication of the MFA bypass means standard security controls don't stop them.
Organizations are being advised to implement additional verification steps for IT support requests—essentially, don't trust a phone call alone, even if it seems to come from the right number. Monitor for unusual login patterns, especially from new locations or at odd hours. Require approval workflows for sensitive actions, so even a compromised admin account can't immediately export all the company's emails. But these are band-aids on a deeper problem: the attack is fundamentally social, and social problems don't have purely technical solutions. The real defense is awareness and skepticism, which is hard to scale across an entire organization.
Citações Notáveis
Attackers create a sense of urgency around a security issue and walk executives through steps that appear to be standard verification procedures— Security researchers tracking the BigBear campaign
Quer a matéria completa?
Leia o original em Google News ↗
Politics & Governance