[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3TwbXk-zih9iuca4Zp_UyI6j2aXLHmBh44teGly4rY8":3},{"article":4,"iocs":47,"watch_terms":54,"solutions":55,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e22f7600-bea3-49a7-b870-d39721b8fbdc","NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions","novacookies-campaigns-abuse-genuine-docusign-notifications-to-steal-microsoft-36-26c527","Cybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies that's used as a proxy to redirect Microsoft 365 sign-ins, while capturing authenticated sessions in the process. In a report shared with The Hacker News ahead of publication, Island characterized the $320\u002Fmonth service as a subscription-based phishing platform that","A new phishing-as-a-service toolkit called NovaCookies is being used to steal authenticated Microsoft 365 sessions. The kit leverages genuine Docusign notifications as lures, redirecting victims through legitimate sign-in endpoints before reaching attacker-controlled infrastructure. NovaCookies captures both credentials and MFA codes, and is advertised on Telegram.","NovaCookies phishing kit steals Microsoft 365 sessions using Docusign notifications.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fnovacookies-campaigns-abuse-genuine.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiz4GD3giiT1DIPT5Q13XvCZcwC8-STaGCZ3KbqUzQ5Q9oniGfA0Odbqfmwva6B-xSSTD2QG1wdqu5fFOleaBVFSA-t3ZfeqpcrYOEomdygWsZOONJXYcpxhRdT-EbTS_DZ0zYLrH_-1YN7TjXCsDuIj0I2G53mFT0df1HC3tjUdUQ5MCdHdEo27rDE2QEm\u002Fs1600\u002Fdocusign.jpg","2026-08-26T13:44:31+00:00","2026-08-26T16:00:30.660923+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Docusign",{"name":23,"type":19},"Okta",{"name":25,"type":26},"OAuth","technology",{"name":28,"type":26},"MFA",{"name":30,"type":19},"Cloudflare","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[48,51],{"type":46,"value":49,"context":50},"NovaCookies","Name of the phishing-as-a-service toolkit",{"type":46,"value":52,"context":53},"Sneaky 2FA","NovaCookies is assessed to be a variant of this kit",[18,21,23],{"controls":56,"vendors":140},[57,85,114],{"slug":58,"name":59,"problem":60,"products":61},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[62,69,77],{"vendor_slug":63,"vendor_name":23,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":86,"name":87,"problem":88,"products":89},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":115,"name":116,"problem":117,"products":118},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":136,"product_name":137,"url":138,"description":139},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[141,144],{"slug":78,"name":79,"logo_path":80,"roles":142},[143],"affected",{"slug":120,"name":121,"logo_path":122,"roles":145},[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":167},"novacookies-phaas-hijacks-docusign-lures-to-bypass-mfa-and-steal-m365-sessions","NovaCookies PhaaS Hijacks Docusign Lures to Bypass MFA and Steal M365 Sessions","The NovaCookies campaign exploits user trust in legitimate Docusign email notifications to lure victims into an adversary-in-the-middle (AiTM) phishing flow that captures both credentials and live MFA tokens, effectively rendering standard multi-factor authentication insufficient on its own. The attack abuses the perceived legitimacy of a well-known SaaS platform to bypass user suspicion, highlighting how threat actors increasingly weaponize trusted brand notifications rather than crafting obviously fake emails. Once a session cookie is stolen, attackers gain persistent, authenticated access to Microsoft 365 environments without needing to re-authenticate. This matters because session hijacking sidesteps even strong MFA implementations, meaning organizations relying solely on MFA as their last line of defense are still exposed to full account takeover.",[152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","NIST IR-6 – Incident Reporting","MITRE ATT&CK T1557 – Adversary-in-the-Middle","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link","GDPR Article 32 – Security of Processing (breach risk from account takeover)","ITIL – Information Security Management (access control and incident response practices)",{}]