New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs
ANY.RUN researchers uncovered the N0va phishkit targeting government, technology, consulting, and healthcare organizations across North America and the EU via device code phishing.
The N0va phishkit uses lures imitating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign to draw victims into a device code authentication flow. After the user completes legitimate authentication, N0va captures access and refresh tokens and abuses token-exchange and device-registration mechanisms to establish persistent SSO access to corporate resources. Because the flow relies on real Microsoft authentication, it can evade MFA-focused detections, and token access can outlive takedown of the phishing page. ANY.RUN says it observed the campaign in sandbox sessions, with targeting spanning government, technology, consulting, and healthcare sectors.
- Uses trusted-brand lures including Microsoft, DocuSign, Zoom, Dropbox, and Adobe Sign
- Device code phishing captures access and refresh tokens after legitimate authentication
- Token exchange and device registration grant persistent SSO access to corporate resources
- Legitimate auth flows create MFA blind spots and complicate SOC investigation
- Targets government, technology, consulting, and healthcare in North America and the EU
- ATT&CK
- T1566.002 Spearphishing LinkT1528 Steal Application Access TokenT1550.001 Application Access Token
- Malware
- N0va
- Countries
- United StatesEuropean Union
From the original article
5 min read at cybersecuritynews.com
Recently, ANY. RUN researchers uncovered N0va, a new phishkit targeting organizations across North America and the EU, including government, technology, consulting, and healthcare. What makes N0va especially relevant for SOC leaders is how it spreads the attack across different layers.
By Balaji N · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.