Malware

NovaCookies

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence2

Some observed instances leveraged legitimate Docusign envelopes to send fraudulent document-share lures with clicks traveling through Microsoft or Google sign-in endpoints prior to reaching the kit.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence2

For around $320 per month, this service packages real-time Microsoft 365 session theft... enabling it to capture the session following password and MFA submission.

T1557Adversary-in-the-MiddleEvidence1

The phishing service then relays Microsoft 365 authentication, enabling it to capture the session following password and MFA submission.

T1557.003DHCP SpoofingEvidence1

"NovaCookies" provides lures, domains, hosting, redirects, and support to relay Microsoft 365 logins in real time to steal authenticated sessions.

Lateral Movement

1 technique

T1550.004Web Session CookieEvidence1

"Once the attacker relays the sign-in and captures the session, they're inside the account for as long as that session stays valid."

Collection

2 techniques

T1557Adversary-in-the-MiddleEvidence1

The phishing service then relays Microsoft 365 authentication, enabling it to capture the session following password and MFA submission.

T1557.003DHCP SpoofingEvidence1

"NovaCookies" provides lures, domains, hosting, redirects, and support to relay Microsoft 365 logins in real time to steal authenticated sessions.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

dark readingNews

Aug 26, 2026

'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month

A commercial adversary-in-the-middle phishing service that relays Microsoft 365 authentication in real time and steals authenticated session cookies, enabling MFA bypass. It supplies buyers with phishing lures, disposable domains and hosting, redirect infrastructure, infrastructure rotation, evasion features such as short-lived context binding and runtime inspection, and an operator interface.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

NovaCookies

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence2

Some observed instances leveraged legitimate Docusign envelopes to send fraudulent document-share lures with clicks traveling through Microsoft or Google sign-in endpoints prior to reaching the kit.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence2

For around $320 per month, this service packages real-time Microsoft 365 session theft... enabling it to capture the session following password and MFA submission.

T1557Adversary-in-the-MiddleEvidence1

The phishing service then relays Microsoft 365 authentication, enabling it to capture the session following password and MFA submission.

T1557.003DHCP SpoofingEvidence1

"NovaCookies" provides lures, domains, hosting, redirects, and support to relay Microsoft 365 logins in real time to steal authenticated sessions.

Lateral Movement

1 technique

T1550.004Web Session CookieEvidence1

"Once the attacker relays the sign-in and captures the session, they're inside the account for as long as that session stays valid."

Collection

2 techniques

T1557Adversary-in-the-MiddleEvidence1

The phishing service then relays Microsoft 365 authentication, enabling it to capture the session following password and MFA submission.

T1557.003DHCP SpoofingEvidence1

"NovaCookies" provides lures, domains, hosting, redirects, and support to relay Microsoft 365 logins in real time to steal authenticated sessions.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

dark readingNews

Aug 26, 2026

'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.