BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

A phishing-as-a-service framework called BigBear 2.0 has bypassed multi-factor authentication at 258 organizations, stealing more than 5,000 Microsoft 365 credentials. The service targets Microsoft 365 users, compromising accounts despite MFA protections. Organizations should review account activity for unauthorized access and strengthen verification methods.