BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

What happened

A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials. [...]

Why it matters

The development may change operating conditions or market expectations around Microsoft. Further confirmation and measurable outcomes matter.

Affected entities

View evidence

2 reports · 1 original report · 2 independent

1. BleepingComputerPrimary source · Supports · EN · 100%
   BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations ↗Sep 7, 2026, 11:39 AM
2. The Hacker NewsIndependent · Supports · EN · 51%
   Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks ↗Sep 7, 2026, 11:51 AM

Claims

• BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations Observed

Conflicts

No material conflict detected in the available evidence.

Timeline

1. September 7, 2026 at 11:39 AMFirst reported
2. Sep 7, 2026, 12:03 PMUnverified · 64/66%

Market move following event

Market reaction is not yet available for this asset and time window.

Score explanation