Actor Profile

NovaCookies is a subscription-based adversary-in-the-middle (AitM) phishing-as-a-service (PhaaS) platform priced at $320/month, advertised via Telegram. The service enables affiliates with minimal technical expertise to conduct credential theft and session hijacking campaigns targeting Microsoft 365 users. Unlike its predecessor Sneaky2FA, NovaCookies operates under a fully managed PhaaS model where infrastructure is hosted centrally by the operator rather than by individual affiliates. The toolkit has been assessed by Proofpoint to be a variant of the Sneaky2FA phishing kit, with expanded support for multiple identity providers including Okta and GoDaddy-federated Entra domains. NovaCookies is commercially motivated, serving cybercriminals seeking turnkey phishing capabilities without requiring deep technical knowledge.

TTPs (Tactics, Techniques, Procedures)

NovaCookies employs adversary-in-the-middle (AitM) techniques to proxy Microsoft 365 authentication flows and harvest session tokens after victims enter credentials and MFA codes (T1557 - Adversary-in-the-Middle, T1539 - Steal Web Session Cookie). The toolkit abuses genuine DocuSign notifications as initial lures (T1566.002 - Phishing: Spearphishing Link), embedding malicious links within shared documents to bypass sender-authentication and reputation checks. Attack chains leverage OAuth error-redirect techniques documented by Microsoft to route victims through legitimate Microsoft or Google sign-in endpoints before reaching attacker-controlled infrastructure (T1566.002). Phishing domains use alternating-case labels (e.g., PwPt-sHaRe, Ms36-AcCeSs) to masquerade as legitimate Microsoft services (T1036 - Masquerading). The platform incorporates anti-analysis mechanisms including Cloudflare gating and debugger detection to evade security scanners (T1497 - Virtualization/Sandbox Evasion). Infrastructure management and customer support are conducted via Telegram (T1102 - Web Service).

Targets & Patterns

NovaCookies campaigns have targeted hundreds of organizations across multiple sectors, with observed victims in the Technology and Enterprise Services industries. Geographic targeting spans the United States, United Kingdom, Canada, Germany, Israel, and the United Arab Emirates. The toolkit specifically targets Microsoft 365 users, with dedicated authentication flows also supporting Okta and GoDaddy-federated Entra domains. The use of DocuSign-themed lures styled as remittance-advice PDF notifications from accounting departments suggests targeting of finance and business operations personnel who regularly handle document-sharing workflows. The broad sectoral and geographic reach reflects the PhaaS model's accessibility to diverse affiliate operators seeking to compromise enterprise credentials and authenticated sessions for subsequent account takeover, business email compromise, or data exfiltration operations.

Historical Context

NovaCookies is assessed by Proofpoint to be a variant of the Sneaky2FA phishing kit. While Sneaky2FA focused primarily on Microsoft accounts, NovaCookies represents an evolution with expanded identity provider support and a shift from self-hosted affiliate infrastructure to a fully managed PhaaS model with centralized hosting. The toolkit emerged within a broader ecosystem of PhaaS platforms that have proliferated in recent months, including AnonyMousKIT (active since early 2024), p1bot.io, Bluekit, ATHR, ZeroTokens, and iAuthFlow V2. This trend reflects the commoditization of sophisticated phishing techniques, lowering barriers to entry for cybercriminals and enabling scaled credential theft and session hijacking campaigns. The OAuth error-redirect technique employed by NovaCookies was publicly documented by Microsoft in March 2026, indicating rapid operationalization of disclosed techniques by PhaaS developers.

Defensive Recommendations

  • Monitor for anomalous OAuth redirect flows and authentication requests originating from unexpected geographic locations or ASNs, particularly those involving legitimate identity provider endpoints followed by unknown domains (T1566.002, T1557)
  • Implement browser-based security controls capable of correlating multi-hop redirect chains across trusted delivery services, identity provider endpoints, and final landing pages to detect AitM phishing infrastructure
  • Block or monitor domains registered under the .vu TLD and domains featuring alternating-case labels mimicking Microsoft services (e.g., PwPt-sHaRe, Ms36-AcCeSs, ClOd-ViEw) in URL filtering and DNS security layers (T1036)
  • Deploy conditional access policies requiring phishing-resistant authentication methods (e.g., FIDO2 security keys, certificate-based authentication) for Microsoft 365 and federated identity providers to mitigate session token theft (T1539)
  • Enhance email security posture to inspect embedded links within documents shared via legitimate services like DocuSign, extending analysis beyond sender authentication checks to content-layer threats (T1566.002)