According to a report from Island, shared ahead of publication, NovaCookies operates as a subscription-based phishing platform priced at $320/month. The service functions as a proxy, sitting between the victim and genuine Microsoft 365 sign-in pages to capture authenticated session cookies in real time.

• The attacks begin with a legitimate-looking Docusign notification, often forwarded or spoofed, to lure targets into clicking a link.

• Victims are then redirected through a malicious proxy that relays their login request to the real Microsoft 365 service.

• Once the victim authenticates, NovaCookies captures the session token, allowing the attacker to maintain access even after the victim logs out.

• The phishing kit is rented as a service, lowering the technical barrier for aspiring attackers.

• Campaigns appear focused on organizations relying on Microsoft 365 for email and collaboration.

• The abuse of genuine Docusign notifications adds a layer of trust, making the phishing attempt harder to detect.

To reduce exposure, organizations should enforce phishing-resistant multi-factor authentication (MFA), such as FIDO2 security keys, and monitor for unusual session activity or impossible travel patterns.

Source: The Hacker News

Has your organization taken steps to harden Microsoft 365 sessions against AitM phishing toolkits like NovaCookies?