Back to threat alerts

NovaCookies: Exploiting Enterprise Trust to Steal Microsoft 365 Sessions

NovaCookies has emerged as a high-volume Adversary-in-the-Middle (AiTM) Phishing-as-a-Service (PhaaS) platform engineered to bypass multi-factor authentication (MFA) and capture Microsoft 365 session tokens. Operating as a modernised, centralised evolution of the legacy "Sneaky 2FA" framework, the platform offers expanded identity provider targeting while managing proxy infrastructure centrally for threat actor affiliates.

Threat alert
August 27, 2026
Multi-Stage Attack Architecture

The platform achieves high delivery rates by chaining legitimate SaaS services and identity endpoints to conceal its operational infrastructure behind trusted domain boundaries until the final proxy hop.
‍

Stage 1: DocuSign Lure Exploitation

Attacks initiate via genuine document-sharing notifications generated directly by DocuSign infrastructure. Because these emails originate from authorised sending IPs, they pass SPF, DKIM, and DMARC checks, bypassing Secure Email Gateway reputation filters. The malicious link resides inside the hosted document viewer itself rather than the email body.

The body of the notification presents a convincing business decoy, typically claiming that an accounting or billing department has shared an urgent "remittance-advice PDF" or invoice. When the recipient clicks the embedded link, their browser opens the legitimate DocuSign online document viewer. The malicious component is hosted inside the shared document itself, which contains a counterfeit document-share notice featuring embedded hyperlinks. This design places the malicious destination beneath the primary inspection layers evaluated by standard email security gateways.
‍

Stage 2: Identity Provider OAuth Error-Redirect Hops

Interacting with the lure document routes browser traffic through Microsoft’s official OAuth 2.0 authorisation endpoint (login.microsoftonline.com) using an attacker-controlled multi-tenant App ID configured with prompt=none. Because silent authentication fails, Entra ID automatically redirects the user's browser to the registered attacker-controlled URI without displaying consent prompts or security warnings.
‍

Stage 3: AiTM Proxying & Session Theft

The victim arrives at a reverse proxy that dynamically renders a mirrored Microsoft 365 login screen, complete with tenant-specific branding. NovaCookies relays credentials and secondary MFA challenges (SMS, TOTP, push notifications) to Microsoft's actual backend in real time. Upon successful authentication, NovaCookies extracts the primary session cookies (ESTSAUTH, ESTSAUTHPERSISTENT), granting the adversary full account access in a clean browser environment.

Anti-Analysis & Infrastructure Topography

Before delivering the dynamic login form, NovaCookies processes incoming connections through a multi-layered scoring engine:

  • Adaptive Visitor Scoring: The platform inspects visitor attributes including IP address reputation, Autonomous System Number (ASN) origin, User-Agent structure, and browser environment markers. Connections originating from cloud data centres, security vendor IP ranges, or automated proxy networks are flagged and served benign decoy pages.
  • Cloudflare Gate Integration: Landing pages utilise Cloudflare infrastructure to enforce Turnstile challenges and bot-management filters, preventing automated scanner bots from inspecting the underlying site.
  • Debugger Execution Timing Checks: To detect manual inspection by security analysts using browser developer tools, client-side scripts measure execution latency across a debugger statement.
  • Short-Lived Context Binding and Proof-of-Work: NovaCookies binds landing URLs to temporary session tokens and requires the visitor's browser to solve a fast computational proof-of-work challenge before rendering the portal. This prevents security tools from asynchronously replaying captured phishing URLs.
    ‍

Infrastructure analysis reveals over 755 campaign domains, with approximately 90% utilising typosquatted brand names registered under the Vanuatu (.vu) top-level domain.

Recommendations
  • Deploy Phishing-Resistant MFA: FIDO2 cryptographically binds authentication to the official domain in the address bar; when presented with a NovaCookies proxy domain, the browser automatically refuses to sign the authentication request.
  • Enforce Strict Conditional Access: Restrict cloud resource access exclusively to corporate-managed or Hybrid Entra ID-joined endpoints. Enable Continuous Access Evaluation (CAE) to monitor session context and automatically revoke tokens if network location or User-Agent attributes shift mid-session.
  • Implement Recursive SaaS & Browser Controls: Configure email gateways to perform deep, recursive inspection of links embedded within hosted SaaS documents. Consider Enterprise Browser controls to enforce Data Loss Prevention rules and prevent credential entry on newly observed TLDs like .vu.
  • Execute Immediate Containment Protocols: If token theft is suspected, revoke all active session tokens and refresh tokens via the IdP admin console, force a global password reset, and audit the tenant for unauthorised OAuth application registrations, newly added MFA authentication methods, and covert Exchange Online inbox rules.

‍