NovaCookies: AitM service that steals Microsoft 365 and Okta sessions

Security researchers have reported the existence of an adversary-in-the-@-@ middle (AitM) type phishing tool called NovaCookies that acts as a proxy to redirect Microsoft 365 login and capture real-time authenticated sessions. According to the media-sharing report by the island firm, NovaCookies is marketed as a subscription service (approximately US $320 per month) and would have already been used against hundreds of organizations in the United States, the United Kingdom, Canada, Germany, Israel and the United Arab Emirates. The Proofpoint firm, for its part, has evaluated NovaCookies as a variant of the kit known as Sneaky2FA, with extended support for other identity providers such as Okta and Entre domains federated by GoDaddy.

What happens and how it works technically: NovaCookies operates as an AitM relay. In a typical chain of attack, the victim receives an apparently legitimate notification (Island has documented the use of actual DocuSign envelopes as decoy) leading to a malicious document or link. This link triggers a number of readdresses, some of which can pass through authentic endpoints of Microsoft or Google, until they reach the infrastructure controlled by the attacker. When the victim reaches the forged login page and completes credentials and MFA codes, the kit retransmits those credentials to Microsoft in real time to complete authentication and capture the resulting session (cookies, tokens, single-use codes).

Two key technical elements make the scam effective: first, the channel of legitimate services (e.g., DocuSign → redirection to Microsoft → attacker relay) makes each jump seem isolated and reliable; second, the real-time relay allows the attacker to convert legitimate authentication into immediate access using captured cookies or tokens. Island also notes that the kit operators use avoidance techniques as doors using Cloudflare and anti-debug checks to avoid being analyzed by automatic scanners.

How it is distributed and managed: the collected evidence indicates that NovaCookies is announced and managed via Telegram, which serves both to attract affiliates and to configure redirections and support. The reported business model is from phishing-as-a-service (PhaaS): the infrastructure is centrally maintained by the operator and the affiliates use it under subscription, in contrast to models where each affiliate deploys its own server. The domains observed in campaigns include unusual extensions such as .vu and URLs with capital-alternating tags to simulate Microsoft organs (e.g., PwPt-sHaRe, Ms36-AcCeSs), a common strategy to evade surface inspection.

Scope and purpose: reports indicate attacks on organizations from various sectors and countries; however, the exact number of victims and the identity of the service operators are not publicly confirmed. Proofpoint and other researchers have related NovaCookies to existing AitM kits families and to the broader trend of fraud commercialisation through PhaaS, which reduces the technical barrier for economically motivated actors. These platforms not only facilitate the capture of tokens, but now offer complementary services (mailbox analysis, lure templates, vishing capabilities with IA) that increase the likelihood of subsequent financial exploitation.

What can be inferred and what remains uncertain: it is reasonable to conclude that NovaCookies facilitates session theft and access to corporate mailboxes when identity controls do not block the AitM relay. What is not yet public and requires more research includes the attribution of the main operator, the precise magnitude of the economic damage linked to these campaigns and whether the infrastructure receives technical support from legitimate third parties without knowing it. It is also an estimate - based on previous patterns - that this PhaaS improves the effectiveness of corporate mail engagement attacks (BEC) and financial fraud.

Real consequences: for organizations and users, the main threat is not only the disclosure of passwords, but the ability of attackers to maintain persistent access to authenticated accounts, temporarily evade MFA and operate from already validated sessions. This facilitates data theft, supplanting for financial fraud and subsequent attacks such as side movements within the network.

Specific measures to be taken by readers (users and administrators): are not generic recommendations but specific and practicable actions:

1) For Microsoft 365 / Azure AD administrators: enable and review conditional access policies (apply location, risk and device compliance restriction), activate the ability to revoke sessions and refresh tokens immediately on suspicion (Microsoft document on how to revoke sessions: https: / / learn.microsoft.com / en-us / azure / active-directory / users-groups-roles / users-revoke-sign-in-sessions), and consider requiring AitM-resistant authentication methods - for example, FIDO2 / passkeys security keys and policies that block flow based on device codes when not necessary.

2) For security equipment: monitor abnormal session start-ups, in particular activity that shows cookies / tokens changes or login from unusual locations / agents; look for OAuth redirections and traffic patterns that indicate real-time relays; add detections for low-reputation domains (such as unusual extensions) and for URLs that use capital case alternation in subdomains. Check mail and SharePoint / OneDrive logs for atypical access after sharing notifications.

3) For end users: be cautious with shared document notices, even if they arrive from a legitimate sender. Instead of opening links within the email or in HTML attachments, access the service directly (e.g. enter DocuSign or OneDrive from your corporate portal) and check the shared content there. Avoid entering credentials or MFA codes on pages whose URL cannot be clearly validated. Educate teams about the possibility of a legitimate mail acting as a carrier of a malicious payload.

4) Additional technical measures: enable advanced phishing protection (ATP / Microsoft Defender for Office 365 or equivalent solutions), use remote navigation or isolation for unknown links, and limit third-party application permissions using OAuth. Review and strengthen SPF / DKIM / DMARC and maintain policies to minimize committed accounts as authenticated senders.

Wider context: NovaCookies is part of a major wave of PhaaS and AitM kits that are rapidly evolving. Commercial groups and services in the clandestine market now offer templates, management in Telegram, and escape modules that make even operators with little experience achieve successful commitments. To understand general technical mitigation of phishing and good defense practices, CISA and Microsoft maintain public guides: for example, CISA offers practical advice on how to protect themselves from phishing https: / / www.cisa.gov / tips / st04-014, and Microsoft documentation on OAuth flows and good authentication practices is a key operational reference ( https: / / learn.microsoft.com / en-us / azure / active-directory / develop / v2-oauth2-auth-code-flow).

Conclusion: NovaCookies does not introduce a new concept, but it does consolidate and market AitM techniques that erode the protection offered by traditional authentication flows. The operational response requires combining more resilient identity measures, screening focused on sessions and changes in user behaviour, and practical training that makes the recipients doubt before following even apparently legitimate links. Until identity platforms technically mitigate these vectors, hygiene and defensive policies are the most effective barrier.