BigBear's phishing panel disables WebAuthn in the browser to beat MFA at 258 organizations

An old mechanism still works here: an Evilginx2-based proxy sits between the victim and Microsoft's real authentication endpoint under a configuration CloudSEK calls "offy," so the victim genuinely completes MFA against Microsoft while the proxy keeps the password and the session cookie that comes back ^[4][5]. The panel then replays that cookie through an API and holds the authenticated session ^[5]. The cryptography itself stays intact; the value of the completed prompt simply moves to whoever holds the cookie.

The detail that decides whether a FIDO2 rollout was worth the budget is the kit's custom JavaScript, which interferes with FIDO2/WebAuthn by disabling the browser functionality that supports it, pushing the target onto a weaker method ^[11]. Enrollment alone does not guarantee enforcement. If a phishable factor remains available on the account, BigBear picks it on the user's behalf, which is why CloudSEK's own guidance pairs phishing-resistant FIDO2/WebAuthn with Conditional Access that requires managed devices instead of geo-location signals ^[10].

Geo signals are the other thing this operation is built to defeat. The platform uses residential proxies matched to the victim's country across 69 countries so Microsoft's authentication servers do not flag the sign-in as anomalous ^[8]. Location-based risk scoring, in this campaign, is a check the attacker passes on purpose.

The counts come from CloudSEK's administrator access to the panel rather than from victim disclosures, in a report shared with BleepingComputer ^[3][15]. Read as arithmetic: 461 organizations appear in the targeting dataset and 258 had at least one completed MFA bypass, a 56 percent conversion ^[2][18], averaging 1.8 completed bypasses per compromised organization ^[19]. Session cookies outnumber plaintext passwords 4,148 to 1,032, about four to one ^[6][16], which tells you what the operators were actually collecting. The three categories also sum to 5,654 against a stated total of 5,137 records, an overlap of 517, so some victims are counted in more than one bucket ^[17].

Scope per compromised session is the whole Microsoft 365 estate: Exchange Online, Teams, SharePoint, OneDrive and Entra ID authentication, plus whatever else is reachable through single sign-on ^[12].

The infrastructure being down does not close the exposure. The phishing nodes have been offline for nearly three weeks, the administration panel remains online, and at least five affiliate operators received stolen credentials in real time through Telegram bots while it ran ^[14][7]. Data already sitting with five tenants of a leased panel stays with them regardless of any takedown. That leaves per-account work: reset exposed passwords, revoke active sessions, refresh tokens, force re-authentication on high-privileged accounts ^[9]. CloudSEK says it notified law enforcement and several affected organizations, which is fewer than 258 ^[13][2].