NovaCookies: New Phishing Kit Steals Microsoft 365 Sessions via Docusign
The $320/month service enables real-time session theft.
1What is NovaCookies?
NovaCookies is a new phishing kit designed to steal Microsoft 365 sessions. Operating on a $320/month subscription model, this service offers real-time session theft capabilities. It has been found targeting hundreds of organizations across the U.S., U.K., Canada, Germany, Israel, and the UAE. Attackers use fake document sharing via Docusign to redirect victims.
2How It Works
NovaCookies leverages genuine Docusign notifications to share fake documents. Victims are redirected through legitimate Microsoft or Google login pages to build trust, only to end up on attacker-controlled infrastructure. The kit captures passwords and multi-factor authentication (MFA) codes, making it more effective than traditional phishing techniques.
3Marketed via Telegram
NovaCookies is advertised on Telegram, which is also used to manage customer profiles and configure redirect services. Proofpoint identified NovaCookies as a variant of the Sneaky 2FA phishing kit. However, NovaCookies includes dedicated flows for other identity providers like Okta and Entra, expanding its reach.
4Phishing-as-a-Service Model
NovaCookies operates on a fully managed Phishing-as-a-Service (PhaaS) model. Affiliates pay to use the platform, with infrastructure centrally hosted by the operator. This model enables cybercriminals with minimal technical expertise to launch large-scale phishing campaigns. Fake URLs hosted on .vu domains mimic Microsoft services to deceive victims.
5Exploiting Docusign Notifications
Attackers use Docusign notifications to lure victims to phishing pages. Since the emails are genuine Docusign notifications, they bypass sender authentication and reputation checks. The malicious document is shared via the service. For example, a fake accounting department shares a remittance advice PDF, prompting the recipient to open it.
6OAuth Redirect Technique
NovaCookies employs an OAuth error-redirect technique detailed by Microsoft in March 2024. This technique redirects victims to attacker-controlled infrastructure. The phishing infrastructure captures credentials and session information in real time. Anti-analysis checks, including a Cloudflare gate, help evade security scanners.
7Structural Shift in PhaaS Market
New PhaaS platforms like EvilTokens automate the front end of attacks, including inbox analysis, stakeholder mapping, and AI-generated fraud messages. This removes the need for affiliates to understand business email compromise tradecraft. Flare security researcher Assaf Morag notes that EvilTokens represents a structural shift in the PhaaS market.
8Cybersecurity Measures
Users must remain vigilant against phishing kits like NovaCookies. Unexpected document sharing requests from services like Docusign should be treated with suspicion. Organizations should continue using multi-factor authentication (MFA) and keep email security solutions updated. AI-based security solutions can play a key role in detecting phishing attacks.