[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foALbHVSaBG-iwMpCCcZ4pZ8KyIWf5PjWrOIGxO7g1Rk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":27,"status":28,"created_at":29,"published_at":30,"article":31,"tags":35,"podcasts":48,"controls":49},"1e800ed5-964d-4c4b-ba77-dfb128230f98","novacookies-phaas-hijacks-docusign-lures-to-bypass-mfa-and-steal-m365-sessions","e22f7600-bea3-49a7-b870-d39721b8fbdc","NovaCookies PhaaS Hijacks Docusign Lures to Bypass MFA and Steal M365 Sessions","The NovaCookies campaign exploits user trust in legitimate Docusign email notifications to lure victims into an adversary-in-the-middle (AiTM) phishing flow that captures both credentials and live MFA tokens, effectively rendering standard multi-factor authentication insufficient on its own. The attack abuses the perceived legitimacy of a well-known SaaS platform to bypass user suspicion, highlighting how threat actors increasingly weaponize trusted brand notifications rather than crafting obviously fake emails. Once a session cookie is stolen, attackers gain persistent, authenticated access to Microsoft 365 environments without needing to re-authenticate. This matters because session hijacking sidesteps even strong MFA implementations, meaning organizations relying solely on MFA as their last line of defense are still exposed to full account takeover.","**Immediate actions:**\n- Deploy phishing-resistant MFA methods (FIDO2\u002Fpasskeys) that bind authentication to the legitimate origin domain, preventing AiTM token theft.\n- Enable Microsoft 365 Conditional Access policies to restrict sessions by device compliance, location, and require continuous access evaluation (CAE) to invalidate stolen tokens rapidly.\n- Warn users to verify unexpected Docusign notification links by navigating directly to the Docusign portal rather than clicking embedded URLs.\n\n**Detection measures:**\n- Configure Microsoft Sentinel or Defender for Cloud Apps alerts on impossible-travel sign-ins, new country logins, and token replay anomalies indicative of session hijacking.\n- Monitor for suspicious OAuth token grants and unfamiliar registered applications appearing in the M365 tenant after any suspicious login event.\n- Establish threat intelligence feeds that track phishing-as-a-service (PhaaS) kits advertised on Telegram and dark web forums to proactively block associated infrastructure.\n\n**Long-term improvements:**\n- Implement a Zero Trust architecture with short-lived session tokens and strict re-authentication requirements for sensitive actions such as email forwarding rule changes or MFA method updates.\n- Conduct regular security awareness training simulating AiTM and brand-impersonation phishing scenarios so employees recognize trust-abuse tactics.\n- Establish an email link isolation or rewriting policy (via a Secure Email Gateway) to defang redirector chains before they reach end users.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","NIST IR-6 – Incident Reporting","MITRE ATT&CK T1557 – Adversary-in-the-Middle","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link","GDPR Article 32 – Security of Processing (breach risk from account takeover)","ITIL – Information Security Management (access control and incident response practices)",{},"published","2026-08-26T16:22:31.784291+00:00","2026-08-26T16:22:31.492+00:00",{"id":7,"url":32,"slug":33,"title":34},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fnovacookies-campaigns-abuse-genuine.html","novacookies-campaigns-abuse-genuine-docusign-notifications-to-steal-microsoft-36-26c527","NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions",[36,42],{"id":37,"name":38,"slug":39,"description":40,"color":41},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":43,"name":44,"slug":45,"description":46,"color":47},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[50,54,58],{"slug":51,"name":52,"problem":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":55,"name":56,"problem":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":59,"name":60,"problem":61},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]