Executive Summary
N0va is a sophisticated phishkit targeting organizations in North America and Europe, specifically across the government, technology, consulting, and healthcare sectors. Unlike traditional phishing that mimics simple login pages, N0va abuses legitimate authentication flows and trusted business platforms such as Microsoft Teams, SharePoint, and DocuSign to appear credible and bypass standard security controls.
The attack chain utilizes device code phishing to trick users into performing legitimate authentication, allowing the adversary to capture access and refresh tokens. This enables the attacker to establish Single Sign-On (SSO) access to corporate resources, potentially maintaining persistence even after initial phishing infrastructure is deactivated. This shift toward identity-based attacks poses a significant risk for account takeover and lateral movement within cloud environments.
Business impact includes potential financial loss through payment fraud, exposure of regulated sensitive data, and operational disruption. Organizations should prioritize monitoring for unusual device registration activity and audit token-exchange mechanisms to mitigate the risk of long-term unauthorized access.