N0va (Threat actor): news timeline & CVEs

Major Cyber Attacks in September 2026: US Organizations Face Session Theft, Remote Access, and Payment Fraud

September campaigns CSuite, N0va, and IronToll phished US organizations for Microsoft 365 sessions, tokens, and payment data.

ANY.RUN's September 2026 roundup describes phishing operations against US and European organizations. CSuite combined Microsoft 365 session theft with remote-management tools including ScreenConnect, Action1, Atera, Syncro, and PDQ Connect; 51% of 351 linked sandbox submissions came from the United States. N0va used device-code phishing to steal Microsoft 365 access and refresh tokens through legitimate authentication flows. IronToll, tied to 114 domains across more than 12 countries, used cloned payment pages and a live operator panel to steal card data and one-time passwords.

ANY.RUNupdated Sep 29, 16:06 UTC · 1d agofirst Sep 29, 08:32 UTC · 2d agoPhishing & fraud in the wild 2 sources2

N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security

N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.

The N0va phishing kit targets organizations in government, technology, consulting, and healthcare across North America and Europe with lures impersonating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Victims are guided through legitimate authentication flows, including device code phishing, after which N0va captures access and refresh tokens and abuses token-exchange or device-registration mechanisms to establish SSO access. ANY.RUN tracks the campaign via a characteristic /api/verification/init URL pattern and demonstrates detection in its interactive sandbox.

The Hacker NewsSep 16, 11:58 UTC · 14d agoPhishing & fraud in the wild5

N0va

Timeline2 articles

Appears with

Major Cyber Attacks in September 2026: US Organizations Face Session Theft, Remote Access, and Payment Fraud

N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security