NovaCookies Phishing Kit Uses Real Docusign Emails to Steal Microsoft 365 Sessions

NovaCookies is a commercial adversary-in-the-middle (AitM) phishing kit that sits between a victim and Microsoft 365, relaying the real sign-in flow while capturing the resulting authenticated session. Island, an enterprise browser vendor, described it as a subscription service priced at $320 per month, or $200 for a 14-day trial, according to a report shared with The Hacker News and Dark Reading.

Because the kit proxies a genuine Microsoft 365 login rather than presenting a static fake page, the victim's password and MFA code pass through to Microsoft normally while NovaCookies intercepts the session cookie issued afterward. Senior Island researcher Shachar Gritzman told Dark Reading that the initial authentication event 'can succeed normally, without malware, an exploit, or a burst of failed logins,' making the sign-in look ordinary to defenders.

One attack chain sends victims a genuine Docusign notification claiming an accounting department shared a remittance-advice PDF, which lets the email pass sender-authentication and reputation checks because Docusign itself sent it. Island noted that 'the malicious destination sat inside the document, below the layer most mail security products inspect,' meaning the email itself contains nothing suspicious for scanners to flag.

Some click paths route through legitimate Microsoft or Google sign-in endpoints as redirect hops before reaching NovaCookies infrastructure, and the kit also reuses an OAuth error-redirect technique that Microsoft documented earlier this year. Each hop, Gritzman said, 'can look legitimate on its own: a trusted delivery service, an identity-provider redirect, then a familiar sign-in page,' with detection only possible by correlating what happens across the full browser journey.

Island said NovaCookies has targeted hundreds of organizations across multiple sectors in the US, UK, Canada, Germany, Israel and the UAE, with more than half of the affected organizations located in or tied to the United States. Dark Reading reported that Island identified at least 755 domains as part of the kit's dedicated infrastructure, which expanded sharply from mid-May 2026 and continued growing into August.

Proofpoint, in a prior X post, assessed NovaCookies as a variant of the Sneaky 2FA phishing kit. Unlike the original Sneaky2FA, which mainly targeted Microsoft accounts, the NovaCookies variant adds dedicated attack flows for Okta and for Entra ID domains federated to GoDaddy, and operates as a fully managed phishing-as-a-service platform where affiliates pay to use centrally hosted infrastructure rather than running their own.

• Many lure domains are registered on the '.vu' top-level domain, such as 'fordmotbvmorcompany[.]vu', according to Island's findings.
• Phishing URLs use alternating-case labels like PwPt-sHaRe, Ms36-AcCeSs and ClOd-ViEw to mimic legitimate Microsoft service names.
• The kit is advertised and managed through Telegram, which is also used to configure redirect services and handle customer support.
• Built-in anti-analysis checks include a Cloudflare gate and a mechanism to detect debugging tools before serving the fake Microsoft 365 login form.

Gritzman told Dark Reading the service includes 'short-lived context binding and runtime inspection' designed to resist automated email scanners, reinforcing that NovaCookies is built for infrastructure durability rather than a single disposable campaign.

Abhishek Agrawal, co-founder and CEO of Material Security, told Dark Reading that NovaCookies 'steals the authenticated session itself, which means MFA, the control most organizations still treat as the endgame for phishing, doesn't factor in at all.' Once a relay captures a valid session, he said, an attacker remains inside the account for as long as that session stays valid, which can be a long time.

Agrawal linked the shift toward session theft to the broader adoption of passkeys and WebAuthn, which has made straightforward credential theft harder and pushed phishing-as-a-service operators to productize session hijacking instead. He argued that 'the dominant model of email security, stopping the bad message at the front door, assumes the front door is where the fight happens,' which breaks down once an attacker walks in with a valid session rather than a stolen password.

Gritzman recommended that organizations assume a phishing incident may expose an authenticated session, not just a password, and prioritize preventing the relay itself. He advised deploying phishing-resistant authentication such as FIDO, starting with privileged and high-impact accounts, and requiring managed devices where practical.

• Detect relays by correlating browser journey signals with device trust, token anomalies and post-authentication activity, per Island's guidance.
• If a relay succeeds, revoke active sessions and refresh tokens rather than relying only on a password reset, which does not invalidate a stolen session.
• Treat genuine Docusign, OneDrive or SharePoint notifications with caution when they carry unexpected document-share links, since sender authentication alone cannot catch malicious content nested inside a shared document.

NovaCookies lets attackers hijack live Microsoft 365 sessions after MFA succeeds, turning a routine sign-in into a full account takeover invisible to password-only defenses.

Security: Because MFA completes normally before the session is stolen, phishing-resistant authentication and post-authentication controls are needed since password resets alone do not revoke an already-active session.

Privacy: Compromised sessions can expose mailbox contents, shared documents and identity data tied to the hijacked Microsoft 365, Okta or Entra account.

Island disclosed NovaCookies, a $320-a-month AitM phishing kit that hides malicious links inside genuine Docusign document-share notifications to steal authenticated Microsoft 365 sessions even after MFA succeeds.