NovaCookies Phishing Service Steals Microsoft 365 Sessions Despite MFA

Researchers identified NovaCookies, a phishing-as-a-service platform that rents adversary-in-the-middle infrastructure for about $320 per month to steal authenticated Microsoft 365 sessions in real time. Victims are lured through trusted-looking DocuSign document-share messages—sometimes involving legitimate DocuSign envelopes—and may be redirected through genuine Microsoft or Google sign-in pages before reaching attacker-controlled infrastructure. After users provide credentials and MFA factors, the service captures session cookies, enabling account takeover despite MFA protections.

NovaCookies has used at least 755 domains, with nearly 90% of observed lures tied to .vu domains, and has targeted hundreds of organizations; 49.2% of observed targeting was directed at U.S. organizations. The platform uses disposable infrastructure, short-lived context binding, proof-of-work challenges, and browser checks to evade automated scanning and analysis. Defenders should prioritize phishing-resistant FIDO authentication, managed-device restrictions, monitoring for browser and token anomalies, and immediate revocation of active sessions and refresh tokens after suspected compromise.