N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va Phishkit targets US and EU businesses with phishing campaigns abusing authentication flows.
The N0va Phishkit is actively targeting organizations in North America and Europe across various sectors, including government, technology, and healthcare. It employs phishing campaigns that impersonate trusted services and exploit legitimate authentication flows to gain access to valid accounts without using obvious malware. This allows attackers to capture access and refresh tokens, establishing single sign-on (SSO) access to sensitive data and cloud resources.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Teams?
Get an email when a new story names Microsoft Teams, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe N0va Phishkit represents a sophisticated evolution in phishing attacks by exploiting legitimate authentication flows rather than deploying traditional malware, making it harder for conventional defenses to detect. Attackers capture OAuth access and refresh tokens, granting persistent SSO access to cloud resources and sensitive data without triggering typical endpoint security alerts. This matters because stolen tokens effectively impersonate a legitimate user session, bypassing multi-factor authentication after the initial compromise. Organizations that rely solely on perimeter defenses or signature-based detection are especially vulnerable, as the attack leverages trusted services to appear credible. The breadth of targeted sectors — government, healthcare, and technology — underscores the widespread risk to critical infrastructure.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.