NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
NovaCookies AitM phishing kit, a Sneaky 2FA variant, uses genuine Docusign lures to steal Microsoft 365 sessions at hundreds of organizations.
Island disclosed NovaCookies, a $320/month adversary-in-the-middle phishing-as-a-service platform that relays Microsoft 365 sign-ins through attacker infrastructure to capture credentials, MFA codes, and authenticated sessions. Campaigns abuse genuine Docusign envelopes and Microsoft/Google redirect hops so each step looks legitimate, with lure domains on .vu and alternating-case labels such as PwPt-sHaRe. Proofpoint assesses NovaCookies as a Sneaky 2FA variant with added flows for Okta and Entra domains federated to GoDaddy, and a fully managed PhaaS model. It has targeted hundreds of organizations in the U.S., U.K., Canada, Germany, Israel, and the U.A.E., and is advertised via Telegram with anti-analysis checks like a Cloudflare gate.
- AitM relay captures passwords, MFA codes, and live Microsoft 365 sessions in real time.
- Genuine Docusign notifications and legitimate Microsoft/Google redirects make each hop trustworthy.
- Proofpoint identifies it as a Sneaky 2FA variant; Telegram is used for sales and management.
- Targets span the U.S., U.K., Canada, Germany, Israel, and the U.A.E.; $320/month subscription.
- Phishing domains use .vu TLD and alternating-case labels masquerading as Microsoft services.
- ATT&CK
- T1557.002 Adversary-in-the-MiddleT1566.002 Spearphishing LinkT1550.004 Use Alternative Authentication Material: Web Session Cookie
- Products
- Microsoft 365NovaCookies
- Threat actors
- Sneaky 2FA
- Malware
- NovaCookies
From the original article
6 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a new adversary-in-the-middle ( AitM ) phishing toolkit called NovaCookies that's used as a proxy to redirect Microsoft 365 sign-ins, while capturing authenticated sessions in the process.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.