BigBear phishing crew nets thousands of Microsoft 365 credentials

CloudSEK identified an active Microsoft 365 phishing-as-a-service campaign, BigBear 2.0, that captured 5,137 records across 461 organizations, including 1,032 plaintext passwords and 4,148 session cookies. The operation obtained 474 fully authenticated, MFA-bypassed Microsoft 365 sessions through adversary-in-the-middle phishing infrastructure, enabling potential access to email, Teams, SharePoint, OneDrive and connected cloud applications. The campaign used residential proxies across 69 countries, FIDO2/WebAuthn suppression scripts and Telegram-based real-time credential delivery, elevating risks of business email compromise, data theft and lateral movement.

Analysis

The near-term MSFT read-through is primarily reputational and support-cost related, not a material revenue event: enterprise buyers will distinguish a credential-harvesting campaign from a Microsoft platform compromise. The more relevant 1-3 month risk is that security teams accelerate conditional-access, token-protection, and managed-device deployments, creating implementation friction for Microsoft 365 migrations but also raising attach rates for Entra ID P2, Intune, and Microsoft security bundles. A meaningful negative MSFT thesis requires evidence of repeatable account-takeover losses, large customer remediation costs, or heightened regulator scrutiny of default identity controls—not merely additional phishing reports.

The economic beneficiary is the identity-control stack that can enforce phishing-resistant authentication and device-bound access rather than legacy MFA alone. PANW and CRWD should capture budget through broader zero-trust and endpoint/device-posture projects; YUBICO is the cleanest hardware-authentication beneficiary, though its smaller liquidity and valuation sensitivity make it unsuitable as a core expression. OKTA has a mixed setup: the threat validates independent identity investment, but its customers may favor platform consolidation into Entra after prior security incidents, limiting multiple expansion.

Consensus may overreact to the apparent MFA-bypass framing. Adversary-in-the-middle attacks exploit session portability and user interaction, so widespread adoption of passkeys, compliant-device rules, and token revocation can materially narrow the attack surface; this is a multi-quarter security-spend catalyst rather than a durable impairment to Microsoft 365's competitive position. Watch whether enterprise surveys and vendor commentary translate into incremental identity-security bookings by the next two earnings cycles.

Key Decisions for Investors

• Do not short MSFT on this incident alone; treat any 2-4% security-headline-driven weakness as a potential entry point only if Azure/M365 consumption and security-bundle guidance remain intact. Falsifier for constructive stance: disclosed customer churn, material remediation expense, or a downward revision to commercial remaining-performance-obligation growth.
• Initiate a 3-6 month relative-value position: long PANW versus short OKTA, sized beta-neutral. PANW has broader monetization from firewall, SASE, endpoint and identity-policy consolidation, while OKTA faces greater platform-consolidation risk; exit if PANW billings guidance weakens or OKTA demonstrates sustained net-retention reacceleration.
• Place YUBICO on an event-driven watchlist rather than chase spot strength; buy only after confirmation that enterprise authentication demand is lifting backlog or forward revenue guidance. A 6-12 month long has asymmetric upside from passkey/FIDO hardware adoption, but require tight sizing given small-cap liquidity and premium multiple risk.
• Monitor CRWD and PANW earnings calls for incremental demand in identity protection, device posture, and incident-response retainers over the next two quarters. If management quantifies incremental bookings from identity-led deals, add exposure; absent disclosed monetization, avoid paying a headline premium for the cybersecurity basket.