A sophisticated new phishing-as-a-service kit named 'NovaCookies' allows attackers to bypass MFA and hijack authenticated Microsoft 365 sessions for a low monthly fee.

  • NovaCookies is an Adversary-in-the-Middle (AitM) service targeting Microsoft 365.
  • The kit bypasses Multi-Factor Authentication (MFA) by stealing session cookies.
  • It operates as a commercial service for as low as $320 per month.

A sophisticated new phishing-as-a-service platform, dubbed 'NovaCookies', has emerged, offering a turnkey solution for cybercriminals to hijack authenticated Microsoft 365 sessions. For a subscription fee of just $320 a month, attackers can bypass even robust Multi-Factor Authentication (MFA) protections, posing a severe threat to enterprise security.

Researchers from the enterprise browser company Island discovered the service. According to senior security researcher Shachar Gritzman, NovaCookies functions as an Adversary-in-the-Middle (AitM) phishing service. It provides everything an attacker needs, including lures, dedicated domains, hosting, and real-time redirects to relay Microsoft 365 logins.

Read Also:Will Fusion Power Startup Commonwealth Fusion Systems Go Public Soon?

Why This Matters

BozokMedia analysis shows that this represents a fundamental shift in cyberattack methodology. While traditional phishing aimed to steal passwords, NovaCookies pivots to session theft. By capturing the authenticated session cookie, attackers can slip past MFA entirely, as the system believes the user has already successfully authenticated.

Once the attacker relays the sign-in and captures the session, they're inside the account for as long as that session stays valid.

The kit is highly organized, operating like a commercial enterprise with at least 755 dedicated domains. Many of the targeted organizations are located in the United States. The attack methods are particularly deceptive, often using genuine Docusign envelopes to deliver counterfeit document-sharing lures, making them difficult for standard email scanners to detect.

Historical Background: The Evolution of Phishing

As the cybersecurity industry has moved toward more secure authentication methods like Passkeys and WebAuthn, attackers have had to evolve. The shift from credential harvesting (stealing passwords) to session hijacking (stealing cookies) is a direct response to the increasing difficulty of traditional phishing. NovaCookies is the productization of this evolution, making high-level technical exploits accessible to low-skill actors.

Abhishek Agrawal, CEO of Material Security, notes that this trend highlights a massive gap in enterprise defense. Most organizations focus on the 'front door' (the login process), but if an attacker walks in with a valid session, perimeter defenses become irrelevant. The industry must move toward a model where even a stolen session provides minimal access to sensitive data.

Did You Know?: Session hijacking is often more dangerous than password theft because it can bypass the most advanced biometric and hardware-based MFA.

Frequently Asked Questions

1. How does NovaCookies bypass MFA?
It uses AitM tactics to intercept the authenticated session cookie after the user has completed the MFA process.

2. What is the best defense against this kit?
Implementing phishing-resistant authentication like FIDO and ensuring all sessions occur on managed, secure devices.