Full Report
Cybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies that's used as a proxy to redirect Microsoft 365 sign-ins, while capturing authenticated sessions in the process. In a report shared with The Hacker News ahead of publication, Island characterized the $320/month service as a subscription-based phishing platform that
Analysis Summary
# Tool/Technique: NovaCookies
## Overview
NovaCookies is a sophisticated, subscription-based Adversary-in-the-Middle (AitM) phishing-as-a-service (PhaaS) platform. It functions as a live relay proxy to intercept Microsoft 365 and Okta authentication flows, allowing attackers to bypass multi-factor authentication (MFA) by capturing authenticated session cookies in real-time.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / AitM Phishing Toolkit
- **Platform:** Web-based (Targeting Microsoft 365, Okta, and Entra/GoDaddy federated domains)
- **Capabilities:** Real-time session hijacking, MFA bypass, anti-analysis/evasion, and Telegram-based management.
- **First Seen:** Reported August 2026 (Assessed as a variant of the "Sneaky 2FA" kit discovered late 2025).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1111 - Two-Factor Authentication Evasion]
- **[TA0007 - Discovery]**
- [T1589.002 - Gather Victim Identity Information: Credentials]
- **[TA0005 - Defense Evasion]**
- [T1564 - Hide Artifacts (Alternating-case URL labels)]
## Functionality
### Core Capabilities
- **AitM Proxy Relay:** Acts as a transparent proxy between the victim and the legitimate identity provider (e.g., Microsoft), capturing credentials and session tokens during the live login process.
- **Fully Managed Infrastructure:** Unlike older kits, NovaCookies hosts all infrastructure centrally; affiliates simply pay a $320/month subscription to use the platform.
- **MFA Bypass:** By capturing the session cookie *after* the victim completes the MFA prompt, the attacker can clone the authenticated session without needing the MFA device.
- **Docusign Abuse:** Exploits genuine Docusign notifications to send malicious links, thereby bypassing email reputation filters and SPF/DKIM/DMARC checks.
### Advanced Features
- **OAuth Error-Redirect Abuse:** Utilizes legitimate Microsoft/Google sign-in endpoints as redirect hops to mask the final destination.
- **Anti-Analysis Gates:** Employs Cloudflare gates to filter traffic and includes mechanisms to detect security scanners and debugging tools.
- **Masquerading:** Uses alternating-case URL labels (e.g., `PwPt-sHaRe`) to mimic legitimate Microsoft services and avoid simple string-based detection.
## Indicators of Compromise
- **File Hashes:** N/A (Web-based infrastructure).
- **File Names:** Remittance-advice PDF (lure document).
- **Network Indicators:**
- `fordmotbvmorcompany[.]vu`
- `*.vu` (Frequent use of the Vanuatu TLD for lure domains).
- Phishing URL labels: `PwPt-sHaRe`, `Ms36-AcCeSs`, `ClOd-ViEw`.
- **Behavioral Indicators:**
- Unexpected OAuth redirects from legitimate Microsoft/Google endpoints to unknown `.vu` domains.
- Logins originating from proxy/hosting infrastructure IPs immediately following user authentication.
## Associated Threat Actors
- **Unidentified Affiliates:** Used by various cybercriminals targeting organizations in the U.S., U.K., Canada, Germany, Israel, and the U.A.E.
- **Platform Developers:** Assessment links the tool to the developers of the **Sneaky 2FA** phishing kit.
## Detection Methods
- **Behavioral Detection:** Monitoring for unusual "Impossible Travel" scenarios in Entra ID/Okta logs where a session is established from a new IP immediately after a successful user login.
- **Network Inspection:** Identifying and blocking traffic to high-risk TLDs (like `.vu`) that use specific URL patterns containing mixed-case Microsoft-related keywords.
- **Header Analysis:** Inspecting X-Forwarded-For headers in authentication logs to identify proxy/relay behavior.
## Mitigation Strategies
- **FIDO2/WebAuthn:** Move away from SMS or App-based OTP towards hardware security keys (FIDO2), which are resistant to AitM phishing.
- **Conditional Access Policies:** Restrict logins to compliant, managed devices or specific geographic locations to minimize the utility of stolen cookies.
- **Security Awareness:** Train users to recognize that genuine services (like Docusign) can be used to deliver malicious content and to verify the final URL in the browser address bar.
## Related Tools/Techniques
- **Sneaky 2FA:** The precursor/base variant of NovaCookies.
- **Evilginx2 / Muraena:** Similar AitM frameworks used for session hijacking.
- **PhaaS (Phishing-as-a-Service):** The broader economic model under which NovaCookies operates.