Researchers at Island have disclosed details of a new phishing platform called NovaCookies, offered on a subscription basis for $320 per month and designed to hijack authenticated Microsoft 365 sessions in real time. The platform operates as an adversary-in-the-middle (AitM) proxy server, allowing attackers to capture victims’ credentials and multi-factor authentication (MFA) codes. According to the researchers, NovaCookies has been used to attack hundreds of organizations across multiple sectors in the US, UK, Canada, Germany, Israel, and the UAE. Organizations using Microsoft 365 are advised to immediately review their conditional access policies and adopt FIDO2 hardware security keys as their primary authentication factor.
Attack mechanism: trusted services as cover
NovaCookies implements a classic AitM phishing scheme but adds several technical features that significantly increase attack effectiveness. The core tactic is using a chain of trusted services, where each individual step appears legitimate on its own.
According to Island, observed campaigns use genuine DocuSign notifications as lures. The attackers create a real DocuSign envelope containing a document with a malicious link. Because the email itself is a legitimate DocuSign notification, it passes sender authentication checks and reputation filters. The malicious payload is embedded inside the document—below the depth at which most email security tools perform inspection. In one documented case, the lure was framed as a notice from the accounting department granting access to a PDF payment order.
After clicking the link, the victim is taken through a series of redirects, including legitimate Microsoft or Google sign-in endpoints, before landing on attacker-controlled infrastructure. Available data indicates that the attack also employs OAuth error-based redirection techniques previously described by Microsoft in March of this year. The NovaCookies phishing infrastructure functions as a real-time AitM relay: it intercepts entered passwords and MFA codes and immediately forwards them to Microsoft servers, obtaining an authenticated session in return.
Infrastructure and evasion techniques
Analysis of the NovaCookies infrastructure revealed several characteristic patterns. A significant portion of lure domains are registered in the .vu top-level domain (Vanuatu). Among the observed indicators of compromise is the domain fordmotbvmorcompany[.]vu. Phishing URLs include labels with alternating character case, such as PwPt-sHaRe, Ms36-AcCeSs, and ClOd-ViEw, mimicking legitimate Microsoft services.
The platform incorporates anti-analysis mechanisms: a Cloudflare gateway to filter automated scanners and a runtime environment detection system for debugger-like tools. These checks run before displaying the fake Microsoft 365 login form.
According to the researchers, NovaCookies is advertised and managed via Telegram, which is used not only for promotion but also as infrastructure for managing customer profiles, configuring redirect services, and providing technical support.
Link to Sneaky 2FA and expanding coverage
Proofpoint assesses NovaCookies as a variant of the well-known phishing kit Sneaky 2FA. However, there are key differences between them. While the original Sneaky 2FA was focused primarily on Microsoft accounts, NovaCookies, according to Proofpoint, includes dedicated flows for other identity providers, including Okta and Entra domains federated with GoDaddy.
Another major difference is the service delivery model. NovaCookies operates as a fully managed service (PhaaS), where the infrastructure is centrally hosted by the platform operator rather than by each affiliate individually. This lowers the barrier to entry for attackers and makes it easier to scale campaigns.
Explosive growth of phishing platforms
NovaCookies is far from an isolated case. In recent months, more than a dozen new phishing services have appeared, each bringing its own innovations:
- iAuthFlow V2 — uses a browser-in-the-middle technique to intercept Google sessions and then registers the attacker’s hardware key, ensuring persistent access. The base package costs $10,000.
- LinXcoded (Mirage2FA) — sends phishing emails from compromised Microsoft 365 tenants, using HTML attachments instead of links to evade email filters.
- ARToken — exploits the OAuth device authorization flow to fully take over Microsoft 365 accounts.
- EvilTokens — automates mailbox analysis after compromise, contact mapping, and the generation of fraudulent messages via AI.
- Balonx Sistema — a Mexican PhaaS operation with an integrated Android RAT and an AI-powered voice phishing component that has harvested data on more than 1,100 users since October 2025.
The trend toward AI integration deserves particular attention: platforms such as ATHR, p1bot.io, and AnonyMousKIT use speech synthesis and large language models to automate voice phishing (vishing), which previously required human operators.
DOUBLOON DREDGER activity
In parallel with the NovaCookies analysis, Sublime researchers observed activity by the group DOUBLOON DREDGER, which abuses Notion accounts to deliver malicious PDF files. Notion simultaneously serves as a legitimate email sender, trusted infrastructure, and hosting platform for the malicious documents. The PDFs contain two or three overlapping links that lead to EvilTokens device code harvesting pages. The target page uses JavaScript obfuscation and encryption techniques similar to those seen in Tycoon 2FA campaigns.
Impact assessment and affected products
The primary impact is on organizations using Microsoft 365 as their main collaboration platform—especially in financial, legal, and corporate sectors where DocuSign is widely used for document exchange. NovaCookies’ expansion to Okta and Entra federated domains means that organizations with hybrid identity architectures are also at risk.
The critical issue is that AitM attacks completely neutralize traditional MFA based on one-time codes (SMS, TOTP, push notifications). The victim enters a valid MFA code, but it is intercepted and used by the attacker in real time.
Protection recommendations
- Switch to FIDO2/WebAuthn hardware keys — this is the only authentication method resistant to AitM attacks, as the key is cryptographically bound to the domain and cannot be relayed through a proxy.
- Configure conditional access policies in Microsoft Entra ID: restrict sign-ins to managed devices, trusted networks, and compliant devices.
- Enable sign-in risk evaluation (Sign-in Risk Policy) with automatic re-authentication requirements when anomalies are detected.
- Monitor .vu domains and URLs with characteristic alternating-case patterns (PwPt-sHaRe, Ms36-AcCeSs, ClOd-ViEw) in proxy and DNS logs.
- Train employees to verify URLs after all redirects, not just the sender’s email domain—especially when working with DocuSign and similar services.
- Set up monitoring for anomalous sessions: a sign-in from a new device or geolocation immediately after a legitimate login may indicate session hijacking.
The emergence of NovaCookies and more than a dozen similar platforms in recent months illustrates a structural shift: phishing is evolving from a craft into a service, with centralized infrastructure, technical support, and AI-powered post-exploitation automation. Organizations that still rely on SMS- or TOTP-based codes as their primary MFA factor should treat migration to FIDO2 as a top-priority security project—not next quarter, but now.
