N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.
The N0va phishing kit targets organizations in government, technology, consulting, and healthcare across North America and Europe with lures impersonating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Victims are guided through legitimate authentication flows, including device code phishing, after which N0va captures access and refresh tokens and abuses token-exchange or device-registration mechanisms to establish SSO access. ANY.RUN tracks the campaign via a characteristic /api/verification/init URL pattern and demonstrates detection in its interactive sandbox.
- Lures impersonate Microsoft Teams, SharePoint, OneDrive, DocuSign, Dropbox, Zoom, and Adobe Sign.
- Chain: device code phishing, token capture, token exchange or device registration, SSO access.
- Compromised identities enable payment fraud, data exposure, and operational disruption.
- ANY.RUN identifies activity via distinctive /api/verification/init URL query pattern.
- ATT&CK
- T1566.002 Spearphishing LinkT1621 Multi-Factor Authentication Request GenerationT1528 Steal Application Access TokenT1098.005 Device RegistrationT1078 Valid Accounts
- Threat actors
- N0va
- Countries
- United States
From the original article
5 min read at thehackernews.com
N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse legitimate authentication flows. Successful attacks can give threat actors access to valid accounts without relying on obvious malware activity. From there, a single compromised identity can open the door to sensitive data, business systems, and additional cloud
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.