BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations and what it means for your security

The BigBear phishing service bypassed Microsoft 365's multi-factor authentication (MFA) protections by using real-time phishing techniques that relay user credentials and MFA responses to Microsoft’s login system as they are entered. This method allowed attackers to gain unauthorized access to accounts at 258 organizations despite MFA being enabled. Understanding BigBear’s tactics and their implications will help Microsoft 365 admins strengthen defenses against similar phishing threats.

How did BigBear bypass MFA in Microsoft 365 phishing attacks?

BigBear used a man-in-the-middle technique where the phishing site acted as a proxy between the user and Microsoft 365. When a user entered their username, password, and completed the MFA challenge on the fake login page, the phishing service immediately forwarded these inputs to the real Microsoft 365 authentication system. This real-time relay allowed the attacker to authenticate successfully without needing to guess or bypass MFA codes.

This method depends on tricking users into interacting with a fraudulent login portal that looks like Microsoft 365’s official page. As the user completes each step of the login, including MFA verification, the attacker captures and transfers the data instantly, establishing a valid session with Microsoft 365. Since the session is legitimate, Microsoft 365 grants access even though the authentication process was initiated through the phishing site.

For example, an employee might receive an email disguised as a Microsoft 365 security alert prompting them to log in. When they enter their credentials and approve the MFA prompt, the attacker uses that information in real time to sign in to the employee’s account. This approach bypasses MFA not by breaking the technology itself but by exploiting the user’s interaction with the phishing page.

What was the scale and impact of the attack across 258 organizations?

The BigBear phishing campaign affected 258 organizations across industries such as finance, healthcare, and technology. These organizations, ranging in size, all depended on Microsoft 365 for email and collaboration, making them prime targets.

Impacts included email account takeovers, unauthorized access to sensitive data, lateral movement within networks, data exfiltration, and ransomware deployment. The attackers tailored phishing messages to each target and acted quickly to exploit credentials once captured.

For instance, one company experienced fraudulent wire transfer requests after email accounts were compromised, while another faced exposure of sensitive patient records due to account breaches. This wide-ranging attack shows that relying solely on MFA does not guarantee protection from sophisticated phishing threats.

Why didn’t MFA stop the BigBear phishing attacks?

MFA adds an important layer of security but assumes users interact directly with legitimate authentication services. BigBear’s attack exploited this assumption by intercepting credentials and MFA codes through a phishing site that relayed them in real time to Microsoft’s servers.

Because the attacker obtains the MFA codes as users enter them, they don’t have to bypass or predict these codes—they use them immediately. Many mistakenly believe MFA alone can prevent all phishing or credential theft, but in cases like this, it only reduces risk rather than eliminating it.

Think of it as having a lock on your door but someone following you in right after you open it. Without additional protections such as anti-phishing tools, strict conditional access policies, or ongoing user training, MFA alone won’t stop attacks that rely on real-time credential interception.

What security steps can organizations take to defend against BigBear-like phishing threats?

To protect your organization beyond MFA, implement a combination of technical controls and user education:

1. Deploy advanced anti-phishing and anti-spoofing solutions that scan emails for malicious links and fake domains.
2. Use Microsoft 365 conditional access policies to block or challenge logins based on unusual locations, devices, or risk levels.
3. Enable Microsoft Defender for Office 365 to detect and block phishing attempts at the email gateway.
4. Train users regularly to recognize phishing attempts, especially fake login prompts and unexpected credential requests.
5. Monitor sessions and sign-in behavior for anomalies, such as logins from new devices or unfamiliar locations.
6. Prefer hardware tokens or app-based authenticators over SMS or email codes to reduce interception risks.
7. Maintain and review incident response plans and security policies to ensure prompt detection and response to compromised accounts.

These layered defenses increase the difficulty for phishing services like BigBear to succeed by addressing weaknesses that MFA alone cannot cover.

Conclusion

The BigBear phishing campaign shows that MFA, while essential, cannot fully prevent attacks that relay credentials and MFA responses in real time. To safeguard your Microsoft 365 environment, combine MFA with anti-phishing technologies, risk-based access controls, session monitoring, and ongoing user training. Staying alert and prepared will help you detect and stop these phishing attempts before they cause serious harm.

Frequently Asked Questions

Can switching to hardware MFA tokens prevent BigBear-style phishing?

Hardware tokens generate codes independently and are harder to intercept than SMS or email codes. However, because BigBear uses real-time relay phishing, attackers can still capture and use hardware token codes immediately. Hardware tokens reduce risk but don’t guarantee full protection against this attack type.

Is it possible to detect if a phishing attack like BigBear was successful in my organization?

Yes. Monitoring for unusual sign-in patterns, such as new device logins or access from unexpected locations, can indicate a compromise. Microsoft 365 provides logs and alerts to help identify suspicious activity. Combining these with endpoint monitoring and threat intelligence improves your chances of detecting successful phishing attacks.