Microsoft 365 Under Siege: Phishers Hijack Sessions

Microsoft 365 users are currently facing sophisticated phishing campaigns designed to steal credentials and bypass multi-factor authentication (MFA). Threat actors are leveraging frameworks like BigBear 2.0, which employ attacker-in-the-middle (AiTM) proxies. These proxies intercept passwords, MFA codes, and session cookies, enabling attackers to hijack legitimate authentication sessions.

Attackers often impersonate IT help desk personnel through phone calls, Microsoft Teams, or email. They then guide victims to fake Microsoft 365 login pages or request remote access, ultimately tricking them into revealing sensitive information. The primary goal is data exfiltration from services such as Outlook, Teams, SharePoint, and OneDrive, with ransomware deployment being rare.

One tracked campaign using BigBear 2.0 successfully exfiltrated over 5,000 credential records, including thousands of session cookies and plaintext passwords. This operation, still active, impacted over 3,300 unique IP addresses across more than 40 countries, with stolen data distributed in real-time to multiple affiliate operators. Many organizations have had at least one set of credentials compromised.

Researchers emphasize the need for enhanced security measures, including phishing-resistant MFA and conditional access policies, particularly for businesses in the US within sectors like healthcare, finance, and professional services. Employee education remains a critical component in combating these evolving threats.