NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions

The NovaCookies campaign exploits user trust in legitimate Docusign email notifications to lure victims into an adversary-in-the-middle (AiTM) phishing flow that captures both credentials and live MFA tokens, effectively rendering standard multi-factor authentication insufficient on its own. The attack abuses the perceived legitimacy of a well-known SaaS platform to bypass user suspicion, highlighting how threat actors increasingly weaponize trusted brand notifications rather than crafting obviously fake emails. Once a session cookie is stolen, attackers gain persistent, authenticated access to Microsoft 365 environments without needing to re-authenticate. This matters because session hijacking sidesteps even strong MFA implementations, meaning organizations relying solely on MFA as their last line of defense are still exposed to full account takeover.