CloudSEK recently uncovered a global Microsoft 365 PhaaS operation that targeted hundreds of organizations across 40+ countries they dubbed “BigBear 2.0.” Their investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, thus revealing how modern AiTM attacks can hijack sessions even if authenticated via MFA.

The researchers identified 48 network IoCs made up of a subdomain, domains, and IP addresses. After extracting unique domains and verifying their ownership legitimacy aided by the WhoisXML API MCP Server, we ended up with a subdomain, 12 domains, and 25 IP addresses, totaling 38 network IoCs, for our analysis.

In the end, our deep dive into the threat led to these discoveries:

• 81 distinct IP addresses that could belong to victims that communicated with 18 of the IP IoCs
• 1,048 email-connected domains, one was confirmed malicious
• Eight additional IP addresses, four were confirmed malicious
• 592 IP-connected domains
• Eight string-connected domains

A sample of the additional artifacts obtained from our analysis is available for download from our website.

A Study of the BigBear 2.0 Subdomain IoC

We began our analysis by querying the sole subdomain IoC on the WhoisXML API MCP Server. We found out that management[.]michaelmarcotte[.]com was first seen on 29 June and last seen on 21 July 2026. And while it did not have Threat Intelligence API hits, it seemed to be part of a 29 June 2026 burst of lookalike auth subdomains beginning with login, mysignins, account, portal, or device according to an analysis of the apex domain. It resembles IoCs connected to credential phishing or fake admin panel staging.

We also learned that there were 18 other subdomains under the apex domain michaelmarcotte[.]com. The www, mail, cpanel, webmail, webdisk, cpcalendars, cpcontacts, ftp, and whm subdomains looked to be legitimate cPanel or hosting infrastructure components first seen between 2017 and 2025. The management, device, login, mysignins, account, portal, honey, cloudfront, cdn, and vn3hg subdomains, meanwhile, all first seen on 29 June 2026, were suspicious as stated earlier.

A Deep Dive into the BigBear 2.0 Domain IoCs

Next up, we zoomed in on the 12 domain IoCs.

We started by querying them on WHOIS API and discovered that:

• They were created between 14 June 2002 and 8 October 2022, making them all relatively old when they were used in the campaign.

  

• While one did not have a registrar on record, the remaining 11 were administered by nine registrars.

  

• While two did not have registrant countries on record, the remaining 10 were registered in six countries.

  

We then queried the domain IoCs on DNS Chronicle API and found out that they recorded 3,230 historical domain-to-IP resolutions over time. Here are more details for five examples.

An Investigation of the BigBear 2.0 IP IoCs

Next, we zoomed in on the 25 IP IoCs.

We learned from sample network traffic data from the IASC that 81 unique IP addresses potentially owned by victims communicated with 18 of the IP IoCs. These IPs fell under 17 distinct ASNs.

We then queried the IP IoCs on Bulk IP Geolocation Lookup and discovered that:

• They were geolocated in nine countries, including the U.S., which also turned up among the domain IoCs’ registrant countries.

  

• They were administered by four ISPs.

  

When queried on DNS Chronicle API, we found out that 22 of the IP IoCs posted 1,012 historical IP-to-domain resolutions over time. Here are more details for five examples.

The Hunt for BigBear 2.0-Connected Artifacts

After unearthing more information about the IoCs, we then hunted for other connected artifacts.

First, we queried the domain IoCs on WHOIS History API and learned that 12 of them had 65 unique email addresses in their historical records. Of these, 16 were public email addresses.

Reverse WHOIS API queries for the public email addresses led to the discovery of 1,048 unique email-connected domains after those already dubbed as IoCs were filtered out. And based on the Threat Intelligence API results we obtained, futureoneenterprises[.]com has already figured in phishing campaigns seen on 22 July 2026.

We queried the email-connected domains on Domain Traffic API next and determined the 10 most visited ones.

Here are more details about the said domains.

We also identified the day when each email-connected domain recorded the highest number of visits.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.