NovaCookies: $320 phishing service steals Microsoft 365 sessions via Docusign and OAuth redirects

What happened

Security vendor Island has documented NovaCookies, a phishing service sold for $320 that has targeted hundreds of organizations, according to a write-up of the research published on dev.to in late August 2026. NovaCookies is a phishing-as-a-service offering built around adversary-in-the-middle (AiTM) attacks on Microsoft 365: it shows victims convincing sign-in pages, forwards whatever they type — passwords, push approvals, one-time codes — to Microsoft's real servers in real time, and then harvests the authenticated session cookies Microsoft hands back. Those cookies give the operator access to the account without ever needing the password again.

How the attack chain works

Distribution starts in channels victims already trust. According to Island's findings, links reach users through legitimate Docusign notification emails, fake document-sharing alerts planted inside document viewers, and compromised but otherwise genuine websites. Since the initial message really is Docusign mail, sender authentication passes and email gateways see nothing amiss.

The transition is the clever part. Rather than linking straight to hostile infrastructure, the attack uses OAuth error redirects tied to applications registered in the attacker's own tenant, or Google sign-in endpoints as relay points, so the browser hops from a recognized domain to the attacker's server. Landing pages sit on .vu domains that mimic brand names, with mixed-case paths that look like document operations — examples in the research include paths resembling 'PwPt-sHaRe' and 'Ms36-AcCeSs'.

Before serving a phishing page, the infrastructure screens its visitor. Client-side proof-of-work challenges, short-lived links tied to a specific context, and checks for automation frameworks or open developer tools all work to keep researchers and scanners out while letting real users through.

The credential theft itself is a live relay. The victim types a password on the fake page; the proxy forwards it to Microsoft. The victim approves an Authenticator push or enters an SMS or OTP code; the proxy forwards that too. Microsoft, seeing valid factors, completes authentication and issues a session cookie — which the AiTM side captures and reuses before it expires.

Why it slips past defenders

For administrators, the resulting sign-ins can look entirely normal, Island notes: no spike in failed logins, no malware on the endpoint, no obvious anomaly in any single log source. Catching it requires correlating the browser's redirect trail, device trust state, token irregularities, and behavior after login. Evidence of actual compromise tends to appear later — new inbox rules or forwarding settings in Exchange Online, OAuth grants to unfamiliar apps, access to SharePoint and OneDrive, or internal phishing sent from the hijacked mailbox.

Island published 755 domain indicators alongside the research, but cautions that traits like .vu registrations or odd mixed-case paths are weak signals on their own and should be weighed together with redirect paths and page behavior.

What to do about it

The research is blunt about what breaks the attack: phishing-resistant, origin-bound authentication such as passkeys or FIDO2 security keys. NovaCookies succeeds precisely when victims rely on MFA methods that are not bound to a legitimate origin — push approvals, OTPs, SMS codes — because the proxy can relay those just as easily as a password.

On the response side, changing a password is not enough. The write-up stresses revoking active sessions and refresh tokens, auditing registered MFA methods and OAuth grants, and blocking the malicious domains. Managed devices and browser policies that restrict credential entry and suspicious redirect chains also shrink the attack surface.

Why it matters

The $320 price tag is the point. Building AiTM infrastructure used to require real capability; NovaCookies rents it out, which means session theft after MFA is now something anyone can buy. Worse, the attack turns the trust anchors enterprises lean on — authenticated Docusign mail, Microsoft and Google redirect endpoints, and MFA itself — into delivery mechanisms and cover. For organizations that treat MFA rollout as the finish line, this is a clear signal that phishing-resistant credentials and rapid session revocation belong in the same plan.