NovaCookies Phishing Kit Steals Microsoft 365 Sessions to Bypass MFA

novacookies is a phishing service that can be rented for US$320 a month, or US$200 for fourteen days. and for that price, it does something most people still believe mfa is supposed to prevent. it can walk away with an already authenticated microsoft 365 session after you successfully complete the login yourself.

the trick is not novel but it definitely matters. the password is not the most valuable thing novacookies steals. the session is. when you log in to microsoft 365, the system hands your browser a cookie. this token essentially says this person already proved who they are, let them work.

novacookies sits in the middle of that authentication flow, relays the real login in real time, and captures the authenticated session once it is issued. your password, your mfa prompt, your approval, all of it happens exactly as designed. the attacker does not need to defeat the second factor afterward because they have the finished authenticated session.

think about what that changes. mfa is the one control most organizations treat as the finish line. turn it on and you are safe, that has been the simplified message for years.

novacookies is built around the assumption that authentication itself is no longer the end of the problem. it does not need to break the lock. it gets between you and the door while you legitimately unlock it, then takes the proof that the door is already opened.

this is not some elite bespoke operation. it is advertised as a subscription. US$320 a month buys access to a maintained phishing service, with domains, hosting, microsoft or google-branded redirect options, an operator interface, and support presented as product features. there is even a US$200 fourteen-day tier.

building and maintaining an adversary-in-the-middle relay takes real skill. renting the capability dramatically lowers that barrier. this sounds eerily like the early days of ransomware-as-a-service, crude early tooling put in the hands of people who could never build it themselves. that is the actual danger here, not the technique, which is known, but the economics. specialist capability is being packaged and sold like software.

the delivery is the clever part. one of the strongest chains island observed starts inside a genuine docusign envelope. the notification originates from infrastructure the recipient already recognizes, and the envelope opens in the legitimate docusign viewer. however, the document inside is counterfeit. from there, some campaigns route the victim through genuine microsoft or google sign-in endpoints before reaching attacker-controlled infrastructure. by the time your browser arrives at the malicious destination, several earlier parts of the journey really were legitimate. the con works because trust is borrowed from genuine services before it is transferred to the threat actor.

there is another detail that matters. the microsoft redirect trick does not require microsoft itself to be compromised. novacookies uses an oauth error-redirect technique where an attacker-controlled application is configured with an attacker-controlled redirect uri. the journey can begin on login.microsoftonline.com and still end somewhere adversary controlled. microsoft and docusign were not breached to make this work. their legitimate services were used as pieces of the delivery chain.

the scale is already real, although targeted is the important word here because island does not claim every target was successfully compromised. researchers found hundreds of organizations across the us, uk, canada, germany, israel, and the uae, and published 755 domains assessed as dedicated malicious infrastructure.

49.2% of the organizations in the reviewed dataset were us-based or us-associated, and nearly 90% were associated with lures hosted on .vu domains. low-volume infrastructure existed in late 2025, registrations accelerated sharply in mid-may 2026, peaked in june, and new infrastructure was still appearing in august. this is not one phishing page. it is an operating platform with disposable infrastructure.

novacookies is not interesting because adversary-in-the-middle phishing is some novel technique. it is not. what makes novacookies interesting is the industrialization of it. domains, hosting, redirects, evasion, session capture, and support are being bundled behind one price. the innovation is increasingly in distribution and accessibility, not in inventing an entirely new attack technique.

the anti-analysis side makes the same point. island observed short-lived context binding, proof-of-work checks, browser inspection, and other runtime controls designed to make automated analysis harder. none of those techniques makes the infrastructure invisible, and island explicitly describes it as scanner-resistant rather than scanner-proof. but packaged together, they give a potential buyer capabilities once requiring considerably more operational work.

if you thought mfa closed this chapter you are unfortunately mistaken. it did not. it raised the bar, exactly as it was supposed to, and the ecrime ecosystem moved to the next layer. once passwords protected by a second factor became harder to reuse, authenticated sessions became a much more valuable target.

that distinction matters because not all mfa is equally exposed to this technique. phishing-resistant authentication such as properly deployed fido2 and webauthn is specifically designed to resist the sort of credential relay conventional adversary-in-the-middle phishing depends on. the lesson is not that mfa failed, because it definitely did not fail. the lesson is that "we have mfa" is no longer a sufficiently precise description of an identity-security strategy.

mfa is still absolutely worth having. it eliminates enormous amounts of low-effort credential abuse. we need to stop treating successful authentication as the end of the conversation. identity security now has to protect what happens before the login, during the login, and after the login.

the thing worth stealing is no longer necessarily the password. increasingly it is the proof you already successfully logged in.

the attackers adapted. the market packaged the adaptation. and the security model now has to move again.