A newly uncovered phishing toolkit dubbed NovaCookies is exploiting authentic Docusign alerts to hijack Microsoft 365 login sessions. The method works by acting as an adversary-in-the-middle (AitM), intercepting users’ login credentials and session information as they navigate through what appears to be legitimate channels.
Produced by the cybersecurity firm Island in its recent report, NovaCookies operates as a subscription-based phishing service that allows criminals to launch real-time attacks against Microsoft 365 accounts. The tool has already been deployed across hundreds of organizations spanning the U.S., U.K., Canada, Germany, Israel, and the UAE. A subscription costs around $320 per month. Island says the platform uses proxy-style attacks to relay credentials and active sessions after victims submit both passwords and multi-factor authentication (MFA) tokens without detecting normal protective barriers.
How NovaCookies Pulls Off the Deception
NovaCookies camouflages its operations using genuine Docusign envelopes. In practice, attackers send legitimate notifications of shared documents. The trap activates when a user clicks through to access a document. They are led via intermediate redirects—sometimes through real Microsoft or Google sign-in pages—before landing on attacker-controlled infrastructure. This layered redirect strategy helps fool email filtering tools and recipients alike.
Once on the malicious site, victims see fake Microsoft 365 login forms and unknowingly provide both credentials and MFA codes. Since the attack functions as an AitM proxy, it captures the live session and grants the attacker access. Anti-analysis techniques—such as Cloudflare gates and checks for debugging tools—are used to avoid detection and make the phishing page seem legitimate.
Origins & Expansion Beyond Microsoft
NovaCookies is built on a phishing-as-a-service (PhaaS) model, meaning the core infrastructure is maintained by its operator while affiliates pay to exploit it. The concept isn’t far off previous kits like Sneaky2FA, but it introduces enhancements—including support for identity providers beyond Microsoft, such as Okta and Entra domains federated through GoDaddy. Proofpoint has confirmed these additions.
Most phishing domains crafted by NovaCookies use the “.vu” extension, with oddly mixed-case subdomains such as “PwPt-sHaRe” or “ClOd-ViEw” to mimic legitimate Microsoft branding. Decoy emails often arrive as Docusign notifications claiming that some official department has shared a remittance-advice PDF. The email itself is genuine, which allows it to bypass typical reputation and sender authentication checks. The malicious content is embedded inside the document, making detection harder at the email filtering stage.
The attack chain takes advantage of an OAuth error redirect technique that mimics normal identity-provider behavior. In effect, each stage—from initial delivery service, to identity provider redirect, to familiar login page—appears harmless. It’s only inside the browser that the full malicious chain is revealed.
Why NovaCookies Reflects a Broader Threat Trend
NovaCookies represents an escalation in what has become a booming underground market for PhaaS tools. These kits are enabling actors—some with little technical sophistication—to conduct targeted attacks at scale. NovaCookies isn’t alone; several newer platforms employ tactics like vishing, browser-based session hijacking, or device code phishing to capture data in high-stakes environments.
While some phishing toolkits focus narrowly on credential theft, NovaCookies goes further by targeting full session tokens. That means possessing a user’s password and MFA code isn’t always enough—the session itself becomes the prize, giving attackers immediate access without needing to reauthenticate.
What this means now: Organizations should review email filtering policies and strengthen anomaly detection around identity redirects and domain inconsistencies. Users must be wary even of genuine-looking notifications and verify shared document links carefully. As PhaaS models grow more sophisticated, the threat of successful phishing campaigns is rising across the enterprise landscape.
