BigBear 2.0 Evilginx2 Phishing-as-a-Service Campaign

CloudSEK researchers identified BigBear 2.0, a rebranding of the Evilginx2 framework operating as a Phishing-as-a-Service (PhaaS) model. Attributed to an operator known as "General Boss," the campaign has exfiltrated over 5,000 records, including 474 complete MFA-bypassed sessions and 4,148 session cookies. The operation utilizes at least five affiliate operators (@Sunagashison, @app_ham, @donplayer00, @workin_161, and @Mazal100) who manage a distributed infrastructure of 42 VPS nodes primarily hosted on Vultr.

Technically, the campaign employs Adversary-in-the-Middle (AiTM) proxies to intercept authentication traffic, including plaintext passwords and session cookies (ESTSAUTH). Key innovations in this version include custom JavaScript injections designed to disable FIDO2/WebAuthn hardware security keys, force MFA downgrades, and block Microsoft's anti-phishing telemetry. The framework also leverages a geo-matched residential proxy pool across 69 countries to bypass conditional access policies and geo-anomaly detection.

This campaign represents a critical risk to global enterprises, particularly in the IT Services, SaaS, and Energy sectors, with significant targeting observed in India, France, and Saudi Arabia. The ability to bypass traditional MFA (SMS, TOTP, Push) through session cookie replay makes this a high-impact threat for initial access, potentially leading to Business Email Compromise (BEC) and ransomware deployment.