N0va phishing lures using trusted cloud infra with no attachments

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•5

This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.