> TritonInfoSec News
Home / Sep 08, 2026 / Story
0
#7 BleepingComputer general September 07, 2026 at 15:39 UTC

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

By Bill Toulas

AI Summary

The BigBear 2.0 phishing-as-a-service framework successfully bypassed MFA at 258 organizations and harvested over 5,000 Microsoft 365 credentials using adversary-in-the-middle token theft techniques. The scale and MFA-bypass capability of this platform underscores that TOTP and push-based MFA alone are insufficient against AitM proxy-based credential theft.

Read full article → https://www.bleepingcomputer.com/news/security/big…

Relevance score: 84.0/100

# More from September 08

  1. 1
    Magento StyleSmuggler zero-day exploited to deploy Linux backdoor BleepingComputer
  2. 2
    Adobe Commerce Zero-Day Exploited to Backdoor Online Stores SecurityWeek
  3. 3
    Hackers exploit new MikroTik RouterOS flaws to hijack routers BleepingComputer
  4. 4
    Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication The Hacker News
  5. 5
    N-able patches max severity N-central flaw amid ongoing attacks BleepingComputer
  6. 6
    N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw The Hacker News
  7. 8
    Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits SecurityWeek
  8. 9
    Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts The Hacker News
  9. 10
    Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released The Hacker News