Cybersecurity researchers have uncovered a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies, offered as a subscription-based service at $320/month. The toolkit operates as a proxy to redirect Microsoft 365 sign-in flows, capturing authenticated session cookies in the process. NovaCookies campaigns abuse legitimate Docusign notification emails to lend credibility to the phishing attempts, making detection more difficult for end users. By intercepting real authentication sessions, attackers can bypass multi-factor authentication (MFA) protections. The platform was analyzed and reported by Island, who shared findings with The Hacker News ahead of publication. This represents a growing trend of phishing-as-a-service (PhaaS) platforms targeting enterprise identity infrastructure. The abuse of genuine third-party service notifications highlights the sophistication of modern phishing campaigns.
NovaCookies is an adversary-in-the-middle (AitM) phishing toolkit and Phishing-as-a-Service (PhaaS) platform priced at $320/month. It operates as a real-time proxy that relays Microsoft 365 authentication through attacker-controlled infrastructure, capturing session cookies, credentials, and MFA codes. The kit is assessed to be a variant of the Sneaky 2FA phishing kit but extends support to additional identity providers including Okta and Entra domains federated to GoDaddy. Attack chains use genuine Docusign envelopes as lure delivery mechanisms — the email itself is a legitimate Docusign notification, but the shared document contains a malicious link embedded below the layer most mail security products inspect. Some clicks are routed through legitimate Microsoft or OAuth redirect endpoints as intermediate hops before landing on attacker-controlled infrastructure, using an OAuth error-redirect technique. Lure domains are predominantly hosted on the '.vu' TLD (e.g., fordmotbvmorcompany[.]vu) and use alternating-case URL labels such as PwPt-sHaRe, Ms36-AcCeSs, and ClOd-ViEw to impersonate legitimate Microsoft services. The kit includes anti-analysis and evasion mechanisms including a Cloudflare gate and debugging tool detection. It is advertised and managed via Telegram. Infrastructure is centrally hosted by the PhaaS operator rather than by each affiliate. A related threat actor, DOUBLOON DREDGER, abuses Notion to invite targets to view PDFs containing malicious links leading to EvilTokens device code harvesting pages, using JavaScript obfuscation and overlapping links within PDFs to evade detection.
1. Implement phishing-resistant MFA (e.g., FIDO2/passkeys) to defend against AitM session theft that bypasses standard MFA. 2. Deploy browser-level security controls capable of correlating multi-hop phishing chains into a single event, as each hop in NovaCookies may appear legitimate in isolation. 3. Educate users to be suspicious of Docusign notifications containing links to unexpected documents, especially those requesting Microsoft 365 sign-in. 4. Monitor for authentication sessions originating from unexpected geographic locations or IP addresses, which may indicate stolen session cookie reuse. 5. Inspect URLs within shared documents, not just email sender addresses, as malicious links may be embedded inside documents below typical mail security inspection layers. 6. Block or flag .vu TLD domains in email and web proxy filters, particularly those with alternating-case labels mimicking Microsoft services. 7. Enable Conditional Access policies in Microsoft 365/Entra requiring compliant devices, which can mitigate the use of stolen session tokens from unmanaged devices. 8. Monitor Telegram for advertised PhaaS services targeting your organization's identity providers. 9. Review OAuth redirect configurations and apply Microsoft's guidance on OAuth redirect abuse. 10. For Notion, monitor for unexpected file shares or PDF invitations from unknown external parties. 11. Deploy email security tools that analyze link destinations within attached documents, not just hyperlinks in email bodies. 12. Consider zero-trust browser or endpoint controls that can detect AitM relay infrastructure in real time.
fordmotbvmorcompany[.]vu, .vu TLD phishing domains, URL patterns: PwPt-sHaRe, Ms36-AcCeSs, ClOd-ViEw (alternating-case labels in phishing URLs), NovaCookies PhaaS Telegram channels (infrastructure and support)
