Loading malware…
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Some observed instances leveraged legitimate Docusign envelopes to send fraudulent document-share lures with clicks traveling through Microsoft or Google sign-in endpoints prior to reaching the kit.
For around $320 per month, this service packages real-time Microsoft 365 session theft... enabling it to capture the session following password and MFA submission.
The phishing service then relays Microsoft 365 authentication, enabling it to capture the session following password and MFA submission.
"NovaCookies" provides lures, domains, hosting, redirects, and support to relay Microsoft 365 logins in real time to steal authenticated sessions.
"Once the attacker relays the sign-in and captures the session, they're inside the account for as long as that session stays valid."
The phishing service then relays Microsoft 365 authentication, enabling it to capture the session following password and MFA submission.
"NovaCookies" provides lures, domains, hosting, redirects, and support to relay Microsoft 365 logins in real time to steal authenticated sessions.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.