The Login Worked. That Was the Attack.
Summary: Researchers at Island disclosed an adversary-in-the-middle phishing service called NovaCookies that rents for $320 a month, or $200 for a fourteen-day trial, and relays Microsoft 365 logins in real time to capture authenticated sessions. The service is reported to target hundreds of organizations across multiple regions with at least 755 domains of dedicated infrastructure, more than half of affected organizations based in or connected to the United States, and infrastructure that expanded sharply from mid-May through August.
Bottom line: The attack chain needs no malware or exploit, so the sign-in event looks ordinary and the controls positioned at the front door are not in its path; the population able to run it is now bounded by $320 rather than by skill.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026