BigBear phishing-as-a-service bypasses MFA at 258 organizations, exposing encoding weaknesses in Microsoft 365 token handling

MFA bypass via phishing-as-a-service reaches hundreds of organizations

0, a phishing-as-a-service framework, has been used to bypass multi-factor authentication at 258 organizations and to harvest more than 5,000 Microsoft 365 credentials, as reported on September 7, 2026. Separately, threat hunters disclosed a separate campaign on the same day that uses IT help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins to target Microsoft 365 and other SaaS offerings, singling out directors, vice presidents, and other executive staff for data theft and extortion.

Both reports describe credential and token theft rather than cryptographic breaks, but practitioners should treat signed-in sessions as compromised when an attacker reaches the token layer, and should rotate refresh tokens and revoke persistent sessions rather than relying on password resets alone. Encoding-focused teams should re-audit how MFA factors are serialised in audit logs: an AitM proxy that relays the factor to the genuine site produces logs that look indistinguishable from a legitimate login.

Education and hardware-wallet disclosures expand the breach footprint

Online maths learning platform Mathspace disclosed on September 7, 2026 that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. S. customers, bringing the total disclosed impact to 81,000 customers.

Both incidents underline that exposure paths often sit in third-party analytics and logistics integrations rather than in the cryptographic layer itself, so tokenisation and field-level redaction of personally identifiable information inside reporting databases should be reviewed against the actual Metabase and ShipMonk data flows.

Unpatched remote-access and router flaws put trust stores and serialised sessions at risk

ConnectWise shared temporary mitigation measures on September 7, 2026 for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week. The same day, researchers detailed worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious VBScript payload to newly connected systems through three unrelated initial access paths: a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake support flow. Hackers are also exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet.

The common thread is that remote-management tools terminate or relay cryptographic sessions inside the network perimeter, so certificate pinning, SSH host-key verification, and outbound egress controls become the only defences left while vendor patches are pending.

Encoding tricks hide payloads in plain sight, including QR codes built from glyphs

A weekly recap published September 7, 2026 noted that attackers are using a scannable QR code built out of text characters to deliver phishing payloads, a technique that still renders when email images are blocked because the code is composed of glyphs rather than embedded raster data. The same recap flagged a trusted software source delivering code that stole credentials, and a protocol designed for secure network management being abused in router hijacks. For encoding practitioners, the practical response is to inspect message bodies as Unicode rather than as rendered text: characters such as full-width letters, mathematical alphanumeric symbols, and tag characters can carry scannable bitmaps without crossing an image-filter boundary.

Reviewers can experiment safely with non-ASCII representations through a Unicode Encoder / Decoder and confirm byte-level output with a Text To HEX converter before writing detection rules.

Cloud and AI tooling widen the attack surface for serialised identity

An Intruder analysis of misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud, published September 7, 2026, found that risk profiles across providers have almost nothing in common, which means a checklist tuned for one cloud will miss serialisation and identity defaults in the others. On the same day, OpenAI appeared to be testing a Writing Style feature for ChatGPT that learns how a user writes by looking at examples from connected apps, a capability practitioners should review for token-leakage risk and for the encoding format used when prompts are transmitted to third-party connectors.

Compression of those transmitted payloads is a related concern; a Gzip Compress & Decompress walkthrough helps reviewers confirm that no sensitive material is being streamed in cleartext beneath the transport layer.

What to check before the next vendor patch window

Reviewers should: rotate Microsoft 365 refresh tokens and revoke persistent sessions for any executive accounts targeted by the BigBear or vishing campaigns, pending a vendor advisory; apply ScreenConnect mitigations before ConnectWise ships its patch later this week; restrict MikroTik SSH exposure and verify host keys against an offline inventory; and add Unicode-aware detection for text-mode QR codes. Mathspace and Trezor customers should treat exposed addresses, parent names, and shipping data as live phishing fodder rather than as inert historical records.