Nova Cookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
Summary: Researchers at Island disclosed a subscription phishing toolkit called NovaCookies, priced at $320 per month, that acts as an adversary-in-the-middle proxy to relay Microsoft 365 sign-ins and capture authenticated sessions after victims enter passwords and MFA codes. Observed campaigns used genuine Docusign envelopes carrying counterfeit document-share lures, with some clicks routed through legitimate Microsoft or Google sign-in endpoints as redirect hops, targeting hundreds of organizations in the U.S., U.K., Canada, Germany, Israel, and the U.A.E.
Why it matters: The lure arrives as a real Docusign notification, so it clears sender-authentication and reputation checks, and the malicious destination sits inside the document below the layer most mail security products inspect. A captured session, not just a password, is what the operator walks away with.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026