Actor Profile

N0va is a threat actor conducting phishing campaigns targeting organizations across North America and Europe. The actor's motivation appears to be financially driven, with objectives including payment fraud, invoice manipulation, and access to sensitive business data. N0va operates by impersonating trusted business platforms (Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, Adobe Sign) and abusing legitimate authentication flows to compromise valid user accounts. The actor's origin and attribution remain unclear from available reporting, but their operational focus spans government, technology, consulting, healthcare, and other high-value sectors across the US and EU.

TTPs (Tactics, Techniques, Procedures)

N0va employs credential harvesting techniques that abuse legitimate authentication mechanisms rather than traditional malware deployment. The attack chain includes: Initial Access via phishing lures impersonating trusted business platforms (T1566.002 - Phishing: Spearphishing Link); Device Code Phishing to guide victims through legitimate authentication flows; Credential Access through capture of access and refresh tokens (T1528 - Steal Application Access Token); abuse of token-exchange and device-registration mechanisms to establish SSO access (T1550.001 - Use Alternate Authentication Material: Application Access Token); and Persistence through compromised identity access to email, files, cloud applications, and corporate resources (T1078.004 - Valid Accounts: Cloud Accounts). The campaign is characterized by a URL pattern: "/api/verification/init?session=*&flow=*prompt_profile=" which serves as a detection signature.

Targets & Patterns

N0va targets organizations across multiple high-risk sectors including government, technology, consulting, and healthcare in North America (specifically the United States) and Europe (European Union). The actor's targeting strategy focuses on organizations that rely heavily on cloud services and trusted business platforms, making the campaign relevant across a wide range of verticals. The selection of victims appears driven by access to sensitive data, business systems, and cloud resources that can be monetized through payment fraud, invoice manipulation, data theft, or operational disruption. The broad sectoral targeting suggests opportunistic victim selection based on successful credential compromise rather than highly selective intelligence collection objectives.

Historical Context

The reporting from September 2026 represents current N0va activity without reference to previous campaigns or historical operations. Related activity can be traced using the characteristic URL pattern in threat intelligence platforms, suggesting the campaign has generated multiple observable instances across different infrastructure and submissions. No direct lineage to previously named campaigns or threat actors is established in the available reporting. The campaign represents an evolution in phishing techniques that prioritize token theft and abuse of legitimate authentication flows over traditional malware-based compromise.

Defensive Recommendations

  • Monitor for suspicious OAuth consent grants and device code authentication flows, particularly those involving external or unrecognized devices (T1528, T1550.001)
  • Implement detection rules for the N0va URL pattern: '/api/verification/init?session=*&flow=*prompt_profile=' in web proxy and email gateway logs
  • Enforce conditional access policies requiring device compliance and MFA for cloud application access, with particular scrutiny on token-based authentication (T1078.004)
  • Deploy behavioral analytics to detect anomalous SSO access patterns, including unusual geographic locations, device types, or access times following authentication events
  • Conduct regular audits of OAuth application permissions and registered devices in Azure AD/Entra ID and other identity providers to identify unauthorized token-exchange or device-registration activity

---

# Geopolitical Context

Geopolitical Context

The N0va phishing campaign represents a persistent threat to transatlantic business infrastructure, targeting high-value sectors including government, technology, consulting, and healthcare across North America and Europe. By impersonating trusted enterprise platforms (Microsoft Teams, SharePoint, DocuSign, Google Drive, Zoom) and exploiting legitimate authentication flows, the campaign demonstrates sophisticated understanding of Western corporate digital ecosystems. The abuse of SSO mechanisms and token-exchange protocols reflects adversary adaptation to cloud-first enterprise architectures prevalent in US and EU markets. The cross-sectoral nature of targeting—spanning government and private industry—suggests either broad opportunistic collection or deliberate efforts to establish persistent access across critical infrastructure and sensitive data repositories. The campaign's focus on identity compromise rather than malware deployment aligns with observed shifts in cyber tradecraft toward living-off-the-land techniques that evade traditional detection.

State Actor Alignment

No state actor attribution is provided in available reporting. The N0va threat actor designation does not correspond to known state-sponsored groups tracked by Western intelligence agencies. The campaign's operational characteristics—credential harvesting via phishing, token abuse, and SSO exploitation—are consistent with both financially motivated cybercrime and espionage operations. Such techniques have been observed in campaigns attributed to Russian-speaking cybercriminal groups, North Korean state actors conducting revenue generation, and Chinese APT groups targeting intellectual property. Without further technical indicators, infrastructure analysis, or government attribution statements, the actor's alignment remains indeterminate. The broad sectoral targeting and geographic focus may indicate either a cybercriminal operation seeking monetizable access or an intelligence collection effort by a state-aligned entity.

Business Impacty pro region

The campaign poses direct risks to transatlantic economic security and data protection frameworks. For the European Union, N0va activity threatens compliance with GDPR and NIS2 Directive requirements, particularly where compromised accounts expose personal data or disrupt essential services in healthcare and government sectors. Member states with significant technology and consulting industries—including Germany, France, and the Netherlands—face elevated exposure. For the United States, targeting of government and healthcare sectors raises concerns about potential violations of HIPAA, compromise of controlled unclassified information, and risks to critical infrastructure as defined under Presidential Policy Directive 21. The campaign's exploitation of widely deployed enterprise platforms (Microsoft 365, Google Workspace) creates systemic risk across both regions' digital economies. If N0va represents state-sponsored activity, the transatlantic targeting pattern may indicate intelligence collection against Western policy coordination, technology development, or economic decision-making. The absence of public attribution complicates coordinated response between US and EU cybersecurity authorities.

Forecast

If N0va activity continues without effective countermeasures, organizations in targeted sectors are likely to experience increased account compromise incidents, particularly those relying heavily on cloud-based authentication without robust conditional access policies or behavioral monitoring. Should the campaign prove to be state-sponsored, attribution statements from US or EU government agencies may emerge within the next 3-6 months, potentially accompanied by sanctions designations or indictments if linked to known adversary infrastructure. If N0va represents cybercriminal activity, law enforcement disruption operations coordinated through Europol or FBI-led task forces may follow established patterns seen in previous phishing-as-a-service takedowns. In the near term, security vendors are likely to enhance detection signatures for N0va's characteristic URL patterns and token abuse techniques, though the campaign's reliance on legitimate authentication flows will continue to challenge traditional perimeter defenses. Organizations that fail to implement phishing-resistant MFA and token-binding controls may face prolonged dwell times and expanded lateral movement by threat actors. Regulatory scrutiny of compromised entities in the EU may intensify under NIS2 incident reporting requirements, potentially driving faster adoption of identity threat detection capabilities across member states.