'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month

New NovaCookies adversary-in-the-middle phishing kit lets low-skill actors steal Microsoft 365 session cookies for $320 per month.

Dark Reading reports on NovaCookies, an adversary-in-the-middle (AitM) phishing service sold for roughly $320 per month. The kit lowers the barrier to entry for attackers to run credential-harvesting attacks against Microsoft 365. It goes beyond credentials by stealing active session cookies, enabling account takeover without triggering MFA.

• AitM phishing service priced at about $320 per month
• Steals Microsoft 365 session cookies, not just credentials
• Lowers the entry barrier for less-skilled threat actors
• Session-cookie theft bypasses MFA protections