Overview
- CloudSEK researchers who gained access to a BigBear 2.0 control panel reported 5,137 stolen credential records including 4,148 session cookies and 474 completed MFA‑bypass authentications with at least 258 organizations compromised.
- Arctic Wolf is tracking a related vishing cluster called PREY‑0058 that lures executives with fake IT help‑desk calls and directs them to operator‑controlled pages that harvest live authentication data.
- The attack uses an Evilginx2‑style adversary‑in‑the‑middle proxy to capture passwords and MFA approvals, then automates session token replay through residential proxy networks such as NodeMaven to avoid location‑based alerts.
- After access, actors perform Entra ID and SharePoint discovery and then bulk‑collect files from SharePoint, OneDrive and Exchange for extortion, with IT service providers and senior staff especially targeted.
- Researchers published IoCs and guidance saying defenders should revoke tokens, reset passwords, enforce phishing‑resistant MFA (FIDO2/WebAuthn), require managed devices via Conditional Access, and monitor for proxy token replay and unusual SharePoint activity.