A new phishing-as-a-service platform has exposed the fragility of standard multi-factor authentication, enabling attackers to steal credentials from hundreds of organizations and over 5,000 Microsoft 365 accounts. The tool, dubbed BigBear 2.0, automates advanced adversary-in-the-middle (AitM) attacks, turning a sophisticated technique into a scalable service for criminals.
The framework operates by inserting itself into the authentication flow, capturing not just passwords but the active session tokens issued after a successful MFA challenge. With these tokens, attackers can hijack authenticated sessions and access cloud environments directly, bypassing the login screen entirely. This shift means defenses focused solely on detecting suspicious login attempts are rendered ineffective, as the malicious activity appears as legitimate user behavior.
The scale of the campaign—compromising 258 distinct organizations—underscores the industrialization of high-end phishing. What was once a bespoke operation for elite attackers is now a subscription-based tool, drastically lowering the skill barrier for mass exploitation. The primary threat is no longer password theft, but real-time session interception.
This development demands a fundamental change in defensive strategy: protecting the session after authentication is complete.
Defending the Post-Authentication Session
Security teams must implement a layered defense that moves beyond traditional MFA. The most critical upgrade is deploying phishing-resistant authentication methods, such as FIDO2 security keys or platform passkeys. These cryptographically bind the login to the legitimate service, making them immune to AitM proxy attacks that capture and replay credentials.
Alongside stronger authentication, organizations should enforce rigorous session lifecycle controls. Implementing shorter validity windows for session tokens and enabling Continuous Access Evaluation policies reduces the time an attacker can use a stolen cookie. It is equally vital to enhance monitoring within active sessions. Security operations must now hunt for behavioral anomalies—like impossible travel, irregular API usage patterns, or bulk data downloads—that indicate a session is compromised.
The era where MFA alone secured the login is over. Defending against modern frameworks like BigBear 2.0 requires securing the entire user session, from the moment of authentication until the very end.
一個新型的「釣魚即服務」平台暴露了標準多因素認證的脆弱性，使攻擊者能從數百間機構及超過 5,000 個 Microsoft 365 帳戶中竊取憑證。這個名為 BigBear 2.0 的工具能自動化執行高級的「中間人」(AitM) 攻擊，將複雜技術轉變為犯罪分子可擴展使用的服務。
此框架透過將自己插入認證流程中運作，不僅捕獲密碼，更會擷取成功通過 MFA 挑戰後發出的現階段工作階段令牌。攻擊者利用這些令牌可劫持已認證的工作階段，並直接存取雲端環境，完全繞過登入畫面。此轉變意味著僅專注於偵測可疑登入嘗試的防禦措施將失效，因為惡意活動會偽裝成合法用戶行為。
此次攻擊行動的規模——涉及 258 間不同機構——突顯了高端釣魚攻擊的工業化。昔日僅為精英攻擊者提供的定制操作，現已成為基於訂閱的工具，大幅降低進行大規模利用所需的技術門檻。現時主要威脅已非密碼竊取，而是即時工作階段攔截。
此發展要求防禦策略進行根本性改變：保護認證完成後的工作階段。
防禦認證後工作階段
安全團隊必須實施超越傳統 MFA 的多層防禦措施。最關鍵的升級是部署具防釣魚功能的認證方法，例如 FIDO2 安全密鑰或平台通行密鑰。這些方法透過加密方式將登入綁定至合法服務，使其對捕獲及重播憑證的 AitM 代理攻擊免疫。
除更強的認證機制外，機構應實施嚴格的工作階段生命週期控制。縮短工作階段令牌的有效時間窗口，並啟用「持續存取評估」政策，可減少攻擊者使用被竊取 Cookie 的時間。加強現行工作階段的監控同樣至關重要。安全運營團隊現需搜尋行為異常——如不可能的旅行軌跡、異常 API 使用模式或大量資料下載——這些都可能表明工作階段已被入侵。
僅憑 MFA 保障登入安全的時代已告終。應對 BigBear 2.0 等現代框架的攻擊，必須保障從認證時刻起直至結束的整個用戶工作階段。