'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month

1. Executive summary

A new adversary-in-the-middle (AitM) phishing-as-a-service (PhaaS) toolkit dubbed "NovaCookies" has been disclosed. The subscription-based platform is priced at $320/month and functions as a proxy to redirect Microsoft 365 sign-ins, capturing authenticated session tokens rather than merely credentials. The service abuses genuine Docusign notification infrastructure to deliver phishing lures, lowering the barrier to entry for threat actors targeting EMEA financial services organisations that rely on Microsoft 365 for identity, email, and collaboration. Because session-token theft bypasses MFA, organisations relying solely on credential + MFA prompts for access control are exposed to full account takeover.

2. Regulatory framing

No specific NIS2 or UK NIS article is directly triggered beyond general incident-response obligations, as nothing in the source material indicates a cross-border essential-service disruption or supply-chain-specific vector.

3. Technical analysis & attack chain

Confirmed attack chain (corroborated by Dark Reading and The Hacker News)

1. PhaaS subscription: The actor obtains access to the NovaCookies platform for $320/month, gaining a hosted AitM infrastructure without needing to build or maintain proxy servers.
2. Lure delivery via genuine Docusign notifications: The attacker abuses legitimate Docusign notification emails to deliver phishing links. Because the notifications originate from genuine Docusign infrastructure, they bypass traditional email security controls (SPF/DKIM/DMARC alignment for the sending domain).
3. AitM proxy interception: The victim clicks the link and is redirected to a proxy that mirrors the Microsoft 365 sign-in page. The proxy relays credentials and MFA challenges in real time to the genuine Microsoft authentication endpoint.
4. Session token capture: Upon successful authentication, the proxy intercepts the session token (cookie) issued by Microsoft. The attacker replays this token to gain authenticated access to the victim's M365 environment without needing the password or subsequent MFA.
5. Post-compromise access: The attacker uses the stolen session to access mailbox, SharePoint, OneDrive, and other M365 services until the session expires or is revoked.

Technical specifics

• Platform: Subscription-based PhaaS; $320/month pricing confirmed by both Dark Reading and Island (per The Hacker News).
• Target: Microsoft 365 sign-in (Azure AD / Entra ID authentication).
• Delivery mechanism: Genuine Docusign notification abuse — the phishing link is embedded within or triggered through legitimate Docusign workflow notifications, exploiting trust in a widely used e-signature platform.
• Attack class: Adversary-in-the-middle (AitM) — real-time proxy-based credential and session interception.
• Bypass: MFA is bypassed because the attacker captures the authenticated session token after MFA is completed, not the MFA code itself.

Confidence caveat: Technical depth beyond the above is limited. The source material does not provide specific proxy infrastructure details, C2 domains, file artefacts, registry keys, or post-compromise tooling. Attribution to a specific threat actor is not claimed in any source; no MITRE ATT&CK actor profile is available. The related Forg365 campaign (corpus-2, corpus-3) is a distinct PhaaS operation ($400/month) and should not be conflated with NovaCookies — it is context on the broader PhaaS trend, not the same toolkit.

4. Mitigation & containment

P1 — Within 24 hours

• Review Entra ID conditional access policies: Enforce token session lifetime reductions and session revocation on anomalous sign-ins. Configure conditional access to require compliant devices for M365 access, which raises the bar for token replay from attacker-controlled infrastructure.
• Audit Docusign notification abuse: Coordinate with email security and procurement teams to assess whether Docusign notification links can be sandboxed or rewritten. Flag emails containing Docusign links that redirect to non-Docusign domains.
• Hunt for active AitM sessions: Query Entra ID sign-in logs for impossible-travel patterns, unfamiliar IP ranges, and sessions where the token was issued from a location inconsistent with the user's typical device/IP profile. Revoke suspicious sessions immediately via Revoke-AzureADUserAllRefreshToken (Microsoft Graph / Azure AD PowerShell).

P2 — Within 72 hours

• Deploy phishing-resistant MFA: Where possible, migrate from OTP/SMS-based MFA to FIDO2 hardware keys or Windows Hello for Business, which bind authentication to the device and are resistant to AitM token capture.
• Configure session controls: In Entra ID, implement session timeout policies and continuous access evaluation (CAE) to shorten the window of opportunity for replayed tokens.
• User awareness: Alert staff — particularly finance, legal, and executive assistants who routinely handle Docusign envelopes — that legitimate Docusign notifications may contain malicious redirect links. Instruct users to verify the final destination URL before entering credentials.

P3 — Within 7 days

• EDR / proxy rules: Deploy web-content filtering rules that block known AitM proxy patterns (reverse-proxied login.microsoftonline.com pages served from non-Microsoft IPs). Configure Secure Web Gateway or ZTNA to inspect TLS for domains impersonating Microsoft authentication endpoints.
• DLP and mailbox rule audit: Establish a recurring audit of mailbox forwarding rules and inbox rules created by non-user-initiated sessions, as these are common post-compromise persistence mechanisms following M365 session theft.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material. The sources describe observable behaviours but no machine-pivotable artefacts.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material does not contain specific strings, file names, registry keys, mutex names, or network artefacts attributable to the NovaCookies toolkit itself. Detection should rely on the behavioural indicators in §5 and standard Entra ID anomaly detection.

7. Sources

• Dark Reading — "'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month" — https://www.darkreading.com/endpoint-security/novacookies-steals-microsoft-365-sessions-320-a-month — 2026-08-26
• The Hacker News — "NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions" — https://thehackernews.com/2026/08/novacookies-campaigns-abuse-genuine.html — 2026-08-26
• The Hacker News — "Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft" — https://thehackernews.com/2026/07/forg365-phaas-targets-microsoft-365.html — 2026-07 (context only — distinct toolkit)
• BleepingComputer — "New Forg365 phishing platform uses AI to target Microsoft 365 accounts" — https://www.bleepingcomputer.com/news/security/new-forg365-phishing-platform-uses-ai-to-target-microsoft-365-accounts/ — 2026-07 (context only — distinct toolkit)

8. Adverse Trace position

NovaCookies represents a continuation of the commoditisation trend in M365-targeting PhaaS — lowering the cost and technical barrier for session-token theft via AitM. The abuse of genuine Docusign notifications as a delivery vector is notable because it exploits trust in a platform that EMEA financial services organisations use routinely for contract execution, making email-security bypass more likely. The $320/month price point is below comparable offerings (Forg365 at $400/month), suggesting broader accessibility to lower-tier actors. No specific threat actor attribution is available; the toolkit is unattributed. We assess the risk to EMEA financial services as elevated but not critical — the attack requires user interaction and does not exploit a software vulnerability, but MFA bypass via session-token theft remains a significant gap for organisations that have not implemented phishing-resistant authentication (FIDO2) or session-bound conditional access. We will monitor for IOCs, infrastructure exposure, and any post-compromise tooling associated with NovaCookies campaigns and update clients as the threat picture develops.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.