NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
-
Security researchers have uncovered a new adversary-in-the-middle (AitM) phishing toolkit dubbed NovaCookies, which is being leveraged in active campaigns that abuse legitimate Docusign notifications to intercept Microsoft 365 authentication sessions.
According to a report from Island, shared ahead of publication, NovaCookies operates as a subscription-based phishing platform priced at $320/month. The service functions as a proxy, sitting between the victim and genuine Microsoft 365 sign-in pages to capture authenticated session cookies in real time.
-
The attacks begin with a legitimate-looking Docusign notification, often forwarded or spoofed, to lure targets into clicking a link.
-
Victims are then redirected through a malicious proxy that relays their login request to the real Microsoft 365 service.
-
Once the victim authenticates, NovaCookies captures the session token, allowing the attacker to maintain access even after the victim logs out.
-
The phishing kit is rented as a service, lowering the technical barrier for aspiring attackers.
-
Campaigns appear focused on organizations relying on Microsoft 365 for email and collaboration.
-
The abuse of genuine Docusign notifications adds a layer of trust, making the phishing attempt harder to detect.
To reduce exposure, organizations should enforce phishing-resistant multi-factor authentication (MFA), such as FIDO2 security keys, and monitor for unusual session activity or impossible travel patterns.
Source: The Hacker News
Has your organization taken steps to harden Microsoft 365 sessions against AitM phishing toolkits like NovaCookies?
-
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login