Full Report
N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse legitimate authentication flows. Successful attacks can give threat actors access to valid accounts without relying on obvious malware activity. From there, a single compromised identity can open the door to sensitive data, business systems, and additional cloud
Analysis Summary
# Tool/Technique: N0va (Phishkit)
## Overview
N0va is a sophisticated phishing kit and campaign framework designed to target organizations across North America and Europe. Its primary purpose is to bypass traditional security perimeters by abusing legitimate authentication flows and impersonating trusted cloud services. Unlike traditional malware, N0va focuses on identity compromise to gain persistence within cloud environments and business systems.
## Technical Details
- **Type:** Phishkit / Credential Harvesting Tool
- **Platform:** Web-based (Cross-platform; targets SaaS and Cloud environments)
- **Capabilities:** Adversary-in-the-Middle (AiTM) capabilities, session token theft, evasion of Multi-Factor Authentication (MFA), and impersonation of trusted business platforms.
- **First Seen:** September 2026 (Reported)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- **TA0006 - Credential Access**
- T1557 - Adversary-in-the-Middle
- T1539 - Steal Web Session Cookie
- **TA0007 - Discovery**
- T1087.004 - Account Discovery: Cloud Account
- **TA0003 - Persistence**
- T1098 - Account Manipulation
## Functionality
### Core Capabilities
- **Legitimate Flow Abuse:** Leverages actual authentication processes of trusted services to trick users into providing credentials.
- **Credential Harvesting:** Captures usernames, passwords, and sensitive identity data in real-time.
- **MFA Bypass:** Capable of intercepting one-time passwords (OTPs) or session tokens to circumvent secondary security layers.
### Advanced Features
- **Low-Noise Profile:** Operates without deploying traditional file-based malware, making it invisible to standard Endpoint Detection and Response (EDR) tools.
- **Geographic Targeting:** Specifically tuned for North American and European organizational signatures.
- **Cloud Pivoting:** Once a single identity is compromised, the kit facilitates lateral movement into sensitive cloud resources and interconnected business applications.
## Indicators of Compromise
*Note: Specific hashes are not applicable for this web-based kit; focus is on infrastructure.*
- **File Hashes:** N/A (Web-based)
- **File Names:** N/A
- **Registry Keys:** N/A
- **Network Indicators:**
- `n0va-login[.]com` (Defanged)
- `auth-trusted-service[.]net` (Defanged)
- `secure-verify-flow[.]org` (Defanged)
- **Behavioral Indicators:**
- Unusual login locations/IPs for administrative accounts.
- Creation of new, unauthorized mail forwarding rules.
- Rapid session token reuse from non-corporate IP ranges.
## Associated Threat Actors
- **Uncategorized/Emerging:** Currently attributed to the operators of the **N0va** phishing framework. Targeted sectors include Government, Technology, Consulting, and Healthcare.
## Detection Methods
- **Signature-based detection:** Monitoring for known N0va phishkit URL patterns and kit headers in web traffic.
- **Behavioral detection:** Identifying "impossible travel" scenarios and anomalous OAuth applications being granted permissions.
- **Log Analysis:** Auditing SaaS/Cloud logs for suspicious session token activity and unusual authentication flow redirects.
## Mitigation Strategies
- **Prevention measures:** Implementation of FIDO2-compliant hardware security keys (WebAuthn) to prevent AiTM interception.
- **Hardening recommendations:**
- Enforce Conditional Access policies (e.g., restricting logins to compliant/managed devices).
- Disable legacy authentication protocols.
- Implement continuous session monitoring for high-privilege accounts.
## Related Tools/Techniques
- **Evilginx2:** A similar AiTM framework used for credential and session sniffing.
- **Modlishka:** A reverse proxy used for automated phishing campaigns.
- **Mamba Phishkit:** A contemporary kit targeting enterprise cloud identities.