NovaCookies Phishing-as-a-Service Targeting Microsoft 365

NovaCookies is a sophisticated Phishing-as-a-Service (PhaaS) platform that has scaled significantly since mid-May 2026, targeting hundreds of organizations globally. The service employs an Adversary-in-the-Middle (AiTM) architecture to relay live Microsoft 365 authentication exchanges, capturing the resulting session cookies after the victim completes password and MFA challenges. This allows attackers to bypass standard multi-factor authentication and achieve full account takeover.

The delivery chains are notably complex, leveraging genuine Docusign notifications and legitimate Microsoft or Google OAuth endpoints as redirect hops to establish trust. The operation relies on highly disposable infrastructure, primarily using .vu domains and brand-themed hostnames with character distortions. Its commercial model provides affiliates with a fully managed environment, including browser-based anti-analysis controls and configurable visitor scoring to evade automated scanners.

This threat highlights the limitations of standard MFA (OTP/SMS/Push) against real-time proxying. Organizations are urged to adopt phishing-resistant authentication, such as FIDO2 or passkeys, which structurally prevents origin-mismatched authentication and effectively neutralizes the AiTM relay technique.