DEV Community

Anoymask
Anoymask

Posted on

NovaCookies: Microsoft 365 AiTM Exploiting Trusted Docusign and Microsoft Redirects

1. Overview

  • Article Title: NovaCookies at scale: Inside the $320 Phishing Service Targeting Hundreds of Organizations
  • Publisher: Island
  • Publication Date: 2026-08-26
  • Source: Island
  • Related Sources: Dark Reading, Island Security Research Artifacts
  • Related Malware / Threat Groups / CVEs / Products: NovaCookies service operators and customers, Microsoft 365, Microsoft Entra ID, Docusign, Google Sign-In
  • Severity: High

2. Executive Summary

NovaCookies guides users to an AiTM infrastructure through legitimate Docusign notifications and Microsoft/Google redirects. It relays passwords and MFA responses entered on fake Microsoft 365 sign-in pages to real Microsoft servers in real time, stealing authenticated session cookies.

3. Attack Flow

From Trusted Delivery Channels to Session Cookie Theft

  1. Links are distributed using legitimate Docusign notifications, fake document-sharing notifications placed inside document viewers, or compromised legitimate sites and online services.
  2. The browser is redirected from trusted domains to the attacker infrastructure by using OAuth error redirects for applications registered in the attacker tenant, or Google sign-in endpoints as relay points.
  3. The incoming browser is evaluated on .vu domains mimicking brand names, and document-operation-style paths with mixed uppercase and lowercase letters.
  4. Client-side Proof-of-Work, short-lived context binding, and checks for browsers, automation, and DevTools are combined to assess whether the visitor is a real user and block automated analysis.
  5. Microsoft 365 sign-in processing is relayed in real time to legitimate Microsoft servers, sequentially passing the user's password, Authenticator push approvals/OTPs, and SMS codes.
  6. Authenticated session cookies issued by Microsoft are acquired on the AiTM side and reused to access the account.

4. Adversary Position and Execution Location

  • A PhaaS user who abuses legitimate emails, Docusign, and redirect services as delivery and transition paths rather than compromising the services themselves.
  • Positioned as an AiTM proxy between the victim's browser and Microsoft 365.

5. Visibility for Victims and Administrators

Victims

  • Pass through legitimate Docusign notifications, document viewers, and Microsoft/Google domains, finally reaching the attacker domain in the last step.
  • Familiar Microsoft 365 sign-in screens and MFA prompts appear, and entered credentials are relayed to legitimate Microsoft via AiTM.

Administrators

  • In Microsoft 365, logins may look like normal successful logins, sometimes without a sudden increase in login failures or malware execution.
  • Detection requires combining a sequence of browser transitions, redirect paths, device trust states, token anomalies, and post-authentication activities.

6. Success and Failure Conditions

Success Conditions

  • The user completes the password and MFA authentication via NovaCookies.
  • An origin-unbound MFA method is used, allowing the AiTM proxy to relay and capture the authentication process and session cookies.
  • Stolen sessions are reused by the attacker before they expire.

Failure Conditions / Risk Mitigation

  • Use phishing-resistant, origin-bound authentication methods such as passkeys or FIDO2 security keys.
  • Limit credential entries to unknown destinations and block suspicious redirect paths using managed devices or browser policies.
  • Post-incident response requires not only changing passwords but also revoking active sessions and refresh tokens.

7. What Happens Upon Success

  • Authenticated session cookies for Microsoft 365 are stolen, and post-MFA sessions are reused.
  • Unauthorized access to mailboxes, files, and cloud applications may occur, alongside subsequent actions such as inbox rules, forwarding settings, or OAuth grants.
  • Because the service is commercialized, attackers without the capability to build their own AiTM infrastructure can easily execute session thefts.

8. Observable Logs

  • Email: Fake sharing notifications placed within legitimate Docusign envelopes, or links inside document viewers. Successful sender authentication does not guarantee safety.
  • Proxy/SWG/DNS: Transitions from legitimate Microsoft/Google redirects to .vu domains mimicking brand names, or paths with mixed uppercase and lowercase letters like PwPt-sHaRe or Ms36-AcCeSs. 755 domain IOCs should be used with recorded public-version context; do not rely on a single characteristic as definitive proof.
  • Endpoint/EDR: Often lacks malware. Browser history, tab/navigation history, and behaviors detecting DevTools or automation environments serve as auxiliary evidence.
  • Identity/IdP: Token reuse after successful legitimate authentication, device/IP/browser mismatches, new MFA methods, OAuth grants, and mailbox rules.
  • SaaS/Cloud: Exchange Online forwarding settings and inbox rules, access to SharePoint/OneDrive, and post-authentication actions using stolen sessions.
  • Network: Real-time relay of victim browser -> AiTM -> Microsoft. Due to short-lived links and context binding, delayed re-access may fail to reproduce.

9. Attack Success Assessment

  • Attack Attempt Observed (Success Unconfirmed): Landing pages, redirects, and reachability to NovaCookies domains are confirmed, but credential entry is unconfirmed.
  • User Interaction Confirmed: Browser artifacts or user interviews confirm that the user entered a password or MFA response into the fake sign-in screen.
  • Malware Execution or Successful Authentication Confirmed: Microsoft 365 authentication success via NovaCookies is confirmed. However, this alone does not confirm session cookie reuse by the attacker.
  • Information Theft or Session Compromise Confirmed: Abnormal reuse of session cookies/tokens, device mismatches, and unauthorized post-authentication actions are confirmed.
  • Subsequent Compromise Confirmed: Mailbox rules, forwarding settings, OAuth grants, data access/exfiltration, and additional phishing are confirmed.

10. Investigation Playbook

  • Trigger: Detection of a link from Docusign passing through Microsoft/Google redirects to NovaCookies IOCs/characteristics, or suspicious Microsoft 365 session activity.
  • Initial Verification: Preserve not only the email, but the document inside the Docusign envelope and the entire redirect path. Confirm with the user whether they entered passwords/MFA, the timestamp, and the device used.
  • Endpoint: Check if browser history, download history, managed device status, and session-related data can be retrieved.
  • Authentication & Cloud: Investigate Entra sign-ins, tokens, MFA, devices, IPs, OAuth grants, mailbox rules, and SharePoint/OneDrive access.
  • Subsequent Actions: Check for session reuse, forwarding settings, data downloads, internal phishing, and new persistence mechanisms.
  • Containment: Revoke active sessions and refresh tokens, change passwords, and verify MFA methods and OAuth grants. Block/report malicious domains and unauthorized app registrations, and prioritize deploying phishing-resistant MFA.
  • Classification Tiers: Separate targeting, clicking, credential entry, authentication success, session reuse, and post-auth compromise.

11. Defense and Detection Ideas

  • Single Events: .vu domains mimicking brand names and document-operation-style mixed-case paths should be treated as weak signals individually, combined with redirect paths and page behavior.
  • Time-Series Correlation: Correlate legitimate Docusign -> registered Microsoft/Google redirect -> NovaCookies landing page -> successful Microsoft 365 authentication -> post-auth actions from a different device/IP.
  • Hunting: Version-control the 755 domain IOCs while simultaneously searching for application IDs, redirect URIs, session anomalies, and mailbox rules.
  • Log Gaps: Email gateways alone cannot see document-viewer links and browser navigation sequences, while IdPs alone may mistake legitimate-looking authentication via AiTM for normal logins.
  • Priority Mitigations: Phishing-resistant authentication such as FIDO2/passkeys. Managed device enforcement and browser/SSE navigation visibility. Phishing incident response including session revocation.

12. Facts / Inference / Hypothesis

Facts

  • NovaCookies was advertised at $320 per month or $200 for 14 days, reportedly including domains, hosting, redirect services, and support. However, no independent evidence of purchases or transactions has been confirmed.
  • Island published 755 dedicated malicious domains and confirmed campaign artifacts indicating that hundreds of organizations were targeted. These artifacts do not imply successful compromise.
  • In the dataset reviewed by Island, approximately 90% of targeted organizations were associated with large-scale delivery campaigns using .vu domains. .vu is not a permanent identifier for NovaCookies.
  • NovaCookies relays passwords, Authenticator push approvals/OTPs, and SMS codes in real time to acquire authenticated session cookies.
  • It increases resistance to automated analysis by combining client-side Proof-of-Work, short-lived context binding, and browser inspections, though it is scanner-resistant, not scanner-proof.
  • Docusign and Microsoft themselves were not compromised; their legitimate services were abused as delivery and redirection paths.

Inference

  • Relying solely on domain blocking is insufficient to keep pace with rental service users and shifting infrastructure; tracking browser navigation sequences and post-auth behaviors is critical.
  • Changing passwords alone leaves stolen sessions active, necessitating the revocation of sessions and refresh tokens.

Hypothesis

  • Campaigns sharing NovaCookies characteristics do not necessarily share the same threat actor; attribution should separate service operators from individual users.

13. MITRE ATT&CK Mapping

  • T1566.002 Phishing: Spearphishing Link (High): Guiding users to AiTM via links embedded in Docusign documents, etc.
  • T1583.001 Acquire Infrastructure: Domains (High): 755 dedicated domains and rapid infrastructure expansion.
  • T1557 Adversary-in-the-Middle (High): Real-time relay of Microsoft 365 authentication.
  • T1539 Steal Web Session Cookie (High): Authenticated session cookies are the primary target.
  • T1078.004 Valid Accounts: Cloud Accounts (Medium): Cloud access following stolen session reuse. Separate evidence is required to confirm actual compromise.

14. Unknowns and Further Investigation

  • The identity of the service sellers, number of buyers, actual payments/orders, and number of successfully compromised organizations.
  • Full access conditions and behaviors against all scanners for each short-lived deployment.

15. Impact on SOCs

While public datasets do not explicitly mention specific regions targeted, Microsoft 365 and Docusign are widely used globally, and the attack chain itself is location-agnostic. SOCs must not rely solely on legitimate senders or successful MFA as proof of safety, but must instead track browser navigation sequences and session reuse.

16. Summary by Target Audience

  • For SOCs: Connect delivery, redirects, browsers, Entra, and post-auth actions; separate clicks from session compromises.
  • For Administrators: Prioritize FIDO2/passkeys, managed devices, session revocation, and audits of OAuth and mailbox rules.
  • For Users: Even when passing through legitimate Docusign or Microsoft screens, verify the final URL and do not complete MFA if anything feels suspicious.

Top comments (0)