Overview
Cybersecurity researchers at Proofpoint have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies that proxies Microsoft 365 sign-ins to capture both credentials and live authenticated sessions. The toolkit is sold as a subscription service for roughly $320 per month and advertised through Telegram, where buyers manage phishing profiles, configure redirects, and get vendor support like any other SaaS product.
Proofpoint assesses NovaCookies as a variant of the previously documented Sneaky 2FA phishing kit.
How the Campaign Works
NovaCookies' defining trick is that its lures ride on genuine Docusign envelope notifications rather than spoofed ones. Campaigns are styled as routine document-share notices — for example, an email claiming an accounting department has shared a remittance-advice PDF — sent through Docusign's real infrastructure. Because the notification itself is authentic, it passes checks that would flag a forged sender domain.
The malicious destination link is concealed "below the layer most mail security products inspect," according to Proofpoint, letting it slip past automated scanning that stops at the visible, legitimate Docusign content.
Once clicked, victims are routed through a chain of redirects — including legitimate Microsoft or Google sign-in endpoints — before landing on an attacker-controlled AitM proxy. Because each hop in the chain independently resolves to a trustworthy service, the overall path is harder for both users and automated defenses to flag as malicious.
AitM Session Theft
NovaCookies operates as a live relay: it sits between the victim and the real Microsoft 365 login flow, passing through password and MFA prompts in real time while capturing the resulting authenticated session cookie. That cookie theft is what makes AitM kits dangerous even against accounts protected by multi-factor authentication — the attacker doesn't need to defeat MFA, only to be a silent relay for it.
Technical Indicators
- Phishing domains hosted on the
.vutop-level domain (e.g.,fordmotbvmorcompany[.]vu) - Alternating-case URL path labels designed to imitate Microsoft branding (
PwPt-sHaRe,Ms36-AcCeSs,ClOd-ViEw) - Abuse of the OAuth error-redirect technique to bounce victims toward attacker infrastructure
- Anti-analysis measures including Cloudflare gating and detection of browser debugging tools
- Support for phishing against Microsoft, Okta, and GoDaddy-federated Entra identity providers
Scope and Targeting
Proofpoint reports NovaCookies campaigns have targeted hundreds of organizations across the United States, United Kingdom, Canada, Germany, Israel, and the United Arab Emirates. No single threat actor or nation-state group has been named as the operator — NovaCookies is sold as a commodity kit to any paying customer, broadening the pool of who can run these campaigns.
Mitigation
- Treat Docusign and other document-sharing notifications with the same scrutiny as any sign-in prompt — hover and verify destination URLs before entering credentials, even when the surrounding email is legitimate.
- Deploy phishing-resistant authentication (FIDO2/WebAuthn hardware keys or platform passkeys) where possible — AitM relays that merely proxy password-and-MFA flows cannot replay a hardware-bound cryptographic assertion.
- Enable session-token binding and Conditional Access sign-in risk policies in Microsoft Entra ID to detect and block session cookies used from anomalous locations or devices.
- Monitor for the identified indicators —
.vudomains, alternating-case Microsoft-lookalike URL paths, and unexpected OAuth error-redirect chains — in email and web proxy logs. - Educate users that a legitimate sender or service (like Docusign) does not guarantee a legitimate destination once a link is clicked, since AitM kits deliberately exploit that trust.