---
id: "2857d0bb-8e75-4fb0-afc4-8d16212ec665"
kind: "link"
title: "Researchers trace BigBear 2.0 phishing kit targeting Microsoft 365 users in 40+ countries"
language: "en"
section: "security"
date: "2026-10-19T20:26:13Z"
updated: "2026-10-19T20:26:13Z"
canonical: "https://tldlog.com/l/researchers-trace-bigbear-2-0-phishing-kit-targeting/"
origin: "master"
translations:
  es: "https://tldlog.com/es/l/investigadores-rastrean-kit-phishing-bigbear-2-0-contra/"
  de: "https://tldlog.com/de/l/forscher-verfolgen-phishing-kit-bigbear-2-0-microsoft-365/"
  fr: "https://tldlog.com/fr/l/chercheurs-retracent-kit-bigbear-2-0-phishing-visant/"
  it: "https://tldlog.com/it/l/ricercatori-rintracciano-kit-phishing-bigbear-2-0-contro/"
  pt-BR: "https://tldlog.com/pt/l/pesquisadores-rastreiam-kit-phishing-bigbear-2-0-que-mira/"
  ru: "https://tldlog.com/ru/l/issledovateli-prosledili-fishingovyy-nabor-bigbear-2-0/"
  zh-Hans: "https://tldlog.com/zh/l/zhuizong-bigbear-2-0-wangluo-diaoyu/"
source:
  name: "circleid.com"
  url: "https://circleid.com/posts/dns-spotlight-bigbear-2.0-phaas-targets-span-40-countries"
  language: "en"
  date: "2026-10-19T16:27:00Z"
---

# Researchers trace BigBear 2.0 phishing kit targeting Microsoft 365 users in 40+ countries

## in plain words

Hackers ran a scam kit that tricked people into giving up their work email logins. Security firm CloudSEK found it, and it hit groups in more than 40 countries. A domain data company then checked the web addresses and internet numbers the scam used.

Security researchers at CloudSEK uncovered a global phishing-as-a-service operation aimed at Microsoft 365 accounts. The group they named “BigBear 2.0” hit hundreds of organizations in more than 40 countries. Their investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure and thousands of stolen credentials and session cookies. The researchers say the case shows how so-called AiTM attacks can take over sessions even when users have multi-factor authentication turned on.

WhoisXML API, a provider of domain research, WHOIS and DNS data, then analyzed the network indicators tied to the campaign. The researchers started with 48 indicators made up of a subdomain, domains and IP addresses. After checking ownership of the unique domains with the help of the WhoisXML API MCP Server, they kept one subdomain, 12 domains and 25 IP addresses, for 38 indicators in total.

The subdomain was first seen on 29 June 2026 and last seen on 21 July 2026. It was part of a burst of lookalike login-style subdomains registered that day, which the researchers say resembles credential phishing or fake admin panel staging. Other subdomains under the same apex domain included common hosting names, which the researchers say appear legitimate, along with several that were first seen on 29 June 2026 and that they describe as suspicious.

The 12 domain indicators were created between 14 June 2002 and 8 October 2022. One had no registrar on record, while the other 11 were administered by nine registrars. Ten had registrant countries on record, spread across six countries. Historical DNS data showed 3,230 domain-to-IP resolutions over time for these domains.

The 25 IP indicators fell under 17 distinct ASNs and were geolocated in nine countries, including the United States. They were administered by four internet service providers. Sample network traffic data showed 81 unique IP addresses, possibly owned by victims, that communicated with 18 of the IP indicators. Historical records showed 1,012 IP-to-domain resolutions for 22 of the IP indicators.

The research gives a detailed view of how the campaign’s infrastructure was built and reused over several years.

Source: [circleid.com](https://circleid.com/posts/dns-spotlight-bigbear-2.0-phaas-targets-span-40-countries)