Cybersecurity researchers uncovered NovaCookies, a subscription-based adversary-in-the-middle phishing toolkit that proxies Microsoft 365 logins and steals authenticated sessions in real time. The service has targeted hundreds of organizations across several countries and appears to be a variant of Sneaky 2FA, with added support for Okta and Entra domains federated to GoDaddy. #NovaCookies #Sneaky2FA #Microsoft365 #Okta #Entra #Docusign #Telegram
Keypoints
- NovaCookies is a $320-per-month phishing-as-a-service platform.
- It uses adversary-in-the-middle relays to steal Microsoft 365 sessions.
- Campaigns abuse genuine Docusign notifications and redirect hops to appear trustworthy.
- The toolkit adds support for Okta and Entra domains federated to GoDaddy.
- Researchers also noted related PhaaS threats such as EvilTokens, Tycoon 2FA, and DOUBLOON DREDGER.
Read More: https://thehackernews.com/2026/08/novacookies-campaigns-abuse-genuine.html