Researchers trace BigBear 2.0 phishing kit targeting Microsoft 365 users in 40+ countries
in plain words
Hackers ran a scam kit that tricked people into giving up their work email logins. Security firm CloudSEK found it, and it hit groups in more than 40 countries. A domain data company then checked the web addresses and internet numbers the scam used.
Full summary
Security researchers at CloudSEK uncovered a global phishing-as-a-service operation aimed at Microsoft 365 accounts. The group they named “BigBear 2.0” hit hundreds of organizations in more than 40 countries. Their investigation exposed the attacker’s admin panel The one or three independent experts who decide a domain dispute. Full definition of panel, affiliate network, phishing Impersonating a trusted party to steal data, often with look-alike domains. Full definition of phishing infrastructure and thousands of stolen credentials and session cookies. The researchers say the case shows how so-called AiTM attacks can take over sessions even when users have multi-factor authentication turned on.
WhoisXML API, a provider of domain research, WHOIS The legacy lookup service for domain registration data, now replaced by RDAP for gTLDs. Full definition of WHOIS and DNS Domain Name System The internet's directory that links domain names to computer addresses. Full definition of DNS data, then analyzed the network indicators tied to the campaign. The researchers started with 48 indicators made up of a subdomain A name created under a registered domain, like shop.example.com. Full definition of subdomain, domains and IP Internet Protocol The internet's basic rules for sending data, using numeric addresses for every connected device. Full definition of IP. After checking ownership of the unique domains with the help of the WhoisXML API MCP Server, they kept one subdomain, 12 domains and 25 IP addresses, for 38 indicators in total.
The subdomain was first seen on 29 June 2026 and last seen on 21 July 2026. It was part of a burst of lookalike login-style subdomains registered that day, which the researchers say resembles credential phishing or fake admin panel staging. Other subdomains under the same apex domain The bare name at the top of a DNS zone, such as example.com. Full definition of apex domain included common hosting names, which the researchers say appear legitimate, along with several that were first seen on 29 June 2026 and that they describe as suspicious.
The 12 domain indicators were created between 14 June 2002 and 8 October 2022. One had no registrar A company that registers domain names for customers with the registry. Full definition of registrar on record, while the other 11 were administered by nine registrars. Ten had registrant The person or organization that holds a domain name registration. Full definition of registrant countries on record, spread across six countries. Historical DNS data showed 3,230 domain-to-IP resolutions over time for these domains.
The 25 IP indicators fell under 17 distinct ASNs and were geolocated in nine countries, including the United States. They were administered by four internet service providers. Sample network traffic data showed 81 unique IP addresses, possibly owned by victims, that communicated with 18 of the IP indicators. Historical records showed 1,012 IP-to-domain resolutions for 22 of the IP indicators.
The research gives a detailed view of how the campaign’s infrastructure was built and reused over several years.