BigBear 2.0 uses Evilginx2 to steal Microsoft 365 credentials and session cookies, bypassing MFA through phishing.