[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbI66N4Scw5VM4zrlH85SbY3ccpHGADvCE-UrrjcetI0":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"0fcaa894-8e83-4587-baba-c342335f3fb2","N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security","n0va-phishkit-targets-us-and-eu-businesses-a-new-challenge-for-identity-security-f2f24e","N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse legitimate authentication flows. Successful attacks can give threat actors access to valid accounts without relying on obvious malware activity. From there, a single compromised identity can open the door to sensitive data, business systems, and additional cloud","The N0va Phishkit is actively targeting organizations in North America and Europe across various sectors, including government, technology, and healthcare. It employs phishing campaigns that impersonate trusted services and exploit legitimate authentication flows to gain access to valid accounts without using obvious malware. This allows attackers to capture access and refresh tokens, establishing single sign-on (SSO) access to sensitive data and cloud resources.","N0va Phishkit targets US and EU businesses with phishing campaigns abusing authentication flows.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fn0va-phishkit-targets-us-and-eu.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEji_HlxXvIPYjLUnTTNbkIHzO8UKX2MISan0W6hxfEB55j5U8GUlvJexOakfaxqEyihcT1mluW0C2l2X73wbAk8V3K514rf7X4N0Iojw-JrbimvmTAAOQ-3aawWLHywrmGYkwyCzl_zZI5FjVdlY2GIVIPIDn0v1EEh4PqQlAh9tkNk5NjRyoILB5-D7gI\u002Fs1600\u002FN0va.jpg","2026-09-16T11:58:00+00:00","2026-09-16T14:00:05.97792+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"N0va Phishkit","threat_actor",{"name":21,"type":22},"Microsoft Teams","product",{"name":24,"type":22},"SharePoint",{"name":26,"type":22},"OneDrive",{"name":28,"type":22},"DocuSign",{"name":30,"type":22},"Google Drive","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":31,"icon":33,"name":34,"slug":35},null,"Identity & Access","identity-access",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":47,"vendors":132},[48,77,103],{"slug":49,"name":50,"problem":51,"products":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":78,"name":79,"problem":80,"products":81},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[82,90,95],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":91,"product_name":92,"url":93,"description":94},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":104,"name":105,"problem":106,"products":107},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":151},"n0va-phishkit-hijacks-legitimate-auth-flows-to-steal-sso-tokens","N0va Phishkit Hijacks Legitimate Auth Flows to Steal SSO Tokens","The N0va Phishkit represents a sophisticated evolution in phishing attacks by exploiting legitimate authentication flows rather than deploying traditional malware, making it harder for conventional defenses to detect. Attackers capture OAuth access and refresh tokens, granting persistent SSO access to cloud resources and sensitive data without triggering typical endpoint security alerts. This matters because stolen tokens effectively impersonate a legitimate user session, bypassing multi-factor authentication after the initial compromise. Organizations that rely solely on perimeter defenses or signature-based detection are especially vulnerable, as the attack leverages trusted services to appear credible. The breadth of targeted sectors — government, healthcare, and technology — underscores the widespread risk to critical infrastructure.",[138,139,140,141,142,143,144,145,146,147,148,149,150],"NIST SP 800-63B (Digital Identity Guidelines – AAL2\u002FAAL3)","NIST AC-2 (Account Management)","NIST AC-17 (Remote Access)","NIST SI-3 (Malicious Code Protection)","NIST IA-5 (Authenticator Management)","CIS Control 5 (Account Management)","CIS Control 6 (Access Control Management)","CIS Control 8 (Audit Log Management)","CIS Control 14 (Security Awareness and Skills Training)","GDPR Article 32 (Security of Processing)","MITRE ATT&CK T1528 (Steal Application Access Token)","MITRE ATT&CK T1566 (Phishing)","ISO\u002FIEC 27001 A.9.4 (System and Application Access Control)",{}]