AINEWS
Twelve months after Proofpoint called the browser level attack on hardware security keys "theoretical," CloudSEK found it weaponized inside the BigBear 2.0 phishing kit.
A phishing kit that strips hardware security keys out of a Microsoft 365 login session has compromised 258 organizations across more than 40 countries, according to CloudSEK's TRIAD threat-intelligence team, which published its findings on September 7, 2026. The kit, called BigBear 2.0, is the first commercial phishing-as-a-service platform observed turning the FIDO2 / WebAuthn authentication downgrade, until now a researcher's theoretical concern, into a routine criminal product.
The technique was first written up as a hypothetical by Proofpoint researchers in August 2025: an adversary-in-the-middle phishing proxy could inject JavaScript into the proxied login page and silently disable FIDO2 / WebAuthn checks in the victim's browser, forcing the user onto a weaker authentication path the proxy can capture. At the time, Proofpoint had not seen the technique used in the wild. Twelve months later, CloudSEK's TRIAD team, which gained administrative access to the BigBear 2.0 control panel, reports that 474 sessions at 258 distinct organizations completed exactly that downgrade and produced full MFA-bypassed Microsoft 365 logins. As one CloudSEK analyst put it, the body of research on the technique gave defenders a runway, and "any organization that read that Proofpoint research and believed they had time to respond before it reached the criminal marketplace was wrong."
The mechanism is a small piece of JavaScript rather than a cryptographic break. BigBear 2.0 is a rebranded Evilginx2, an open-source adversary-in-the-middle reverse-proxy phishing framework, wrapped in a paid platform. The default phishlet, "offy," targets Microsoft 365's OAuth 2.0 / Entra ID login flow. When a victim lands on the proxy, the kit rewrites the page in real time, removes FIDO2 / WebAuthn from the authentication options the user sees, and serves only the password-plus-secondary-factor combinations the proxy can intercept. Hardware security keys, which would normally complete a challenge outside the browser, are never offered. The platform runs a wildcard DNS setup with auto-provisioned Let's Encrypt certificates and a 69-country residential proxy pool that geo-matches the victim's IP, both aimed at slipping past anti-bot checks like ipapi.is.
The numbers CloudSEK pulled from the admin panel are the most concrete evidence yet of how much damage the downgrade can do once it is industrialised. Across 5,137 exfiltrated credential records, the team counted 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies, all harvested in real time via Telegram exfiltration bots and shipped to at least five affiliate operators. Victims spanned 3,331 unique IPs, with India, France, Saudi Arabia, New Zealand, and Germany leading. BleepingComputer's independent coverage confirms the 258-organization figure and the panel-derived methodology.
The operator behind BigBear 2.0 goes by "General Boss" and runs the panel from a fleet of 42 VPS nodes, 26 of which had been deleted by late July 2026. That burn pattern reads as the operator reacting to the panel intrusion. Hosting was concentrated on The Constant Company LLC (Vultr). At the time of CloudSEK's write-up, the phishing infrastructure had been offline for roughly three weeks, but the admin panel itself remained reachable. CloudSEK says it has notified law enforcement and the affected organizations.
For defenders, the case reframes the clock. Vendor guidance has long pointed to phishing-resistant MFA, including FIDO2 hardware keys, platform passkeys, and Windows Hello, as the floor. Microsoft's Entra blog on defeating AiTM phishing and CISA's Phishing-Resistant MFA fact sheet both treat that floor as the response to traditional proxy phishing. The CloudSEK report is the first public evidence that the response can be selectively dismantled inside a single browser session before the user ever sees the security-key prompt. Organizations that treated "phishing-resistant MFA" as a checkbox rather than a defended authentication path inherited a research-paper defense against a criminal-product offense.
The next Proofpoint-class research write-up is already on the runway. The question for security teams is no longer whether a technique described in defensive research will reach the criminal marketplace, but how to instrument Microsoft 365 logins so the absence of a FIDO2 / WebAuthn prompt is itself an alert.