As reported by The Hacker News, the N0va phishkit is actively targeting organizations across North America and Europe through phishing campaigns that impersonate trusted business platforms and abuse legitimate authentication flows. What makes this campaign particularly notable is its reliance on valid credential theft rather than malware deployment — a shift that renders many endpoint-focused defenses irrelevant.

Threat Alert: As reported by The Hacker News, the N0va phishkit is actively targeting organizations across North America and Europe through phishing campaigns that impersonate trusted business platforms and abuse legitimate authentication flows.

Why This Matters: The Identity Perimeter Is the New Battlefield

N0va represents an evolution in adversary-in-the-middle (AiTM) phishing that we at Shield53 have been tracking as a growing trend across 2025–2026. The phishkit doesn't need to drop a payload or establish persistence on an endpoint. Instead, it intercepts authentication tokens in real time, replaying them to access cloud services directly. This means your EDR, your antivirus, and your application allow-listing all watch the wrong layer of the attack chain.

The sectors N0va is targeting — government, technology, consulting, and healthcare — share a common vulnerability profile: heavy reliance on Microsoft 365 and cloud-hosted business platforms, federated identity, and large numbers of external collaboration touchpoints. Every shared SharePoint link, every Teams invitation from an external party, every OneDrive collaboration request is now a potential attack vector.

The most dangerous aspect of N0va isn't technical sophistication — it's operational discipline. By living entirely within legitimate authentication flows, the attackers generate traffic that looks normal to most SIEM rules.

What Defenders Are Missing

Organizations that rely on user-reported phishing as their primary detection mechanism are operating at a disadvantage with kits like N0va. The phishing pages are convincing enough that many victims never realize they've been compromised, and the session token theft happens in milliseconds — faster than any human can react. By the time someone reports a suspicious login, the attacker has often already accessed mailboxes, file repositories, or admin consoles.

The ANY.RUN threat intelligence lookup pattern referenced in the source article — url:"/api/verification/init?session=*&flow=*prompt_profile=" — is a useful starting point for hunting, but defenders should treat this as one indicator among many. Phishkit operators rotate infrastructure and URL structures frequently. Building detections around behavioral patterns (impossible travel, anomalous OAuth grants, unexpected session origination) will outlast any single URL pattern.

Key Risk Factors

What Defenders Are Missing
Organizations without Conditional Access policies enforcing device compliance, location, and risk-based authentication
Environments lacking session token revocation procedures — many teams can reset passwords but don't know how to invalidate active refresh tokens
Users with standing privileged access rather than just-in-time elevation, amplifying the blast radius of any single compromised identity
Absence of OAuth application monitoring, allowing attackers to register malicious apps that maintain persistent access even after password resets

Shield53 Recommendations

Immediate Actions

  • Enforce phishing-resistant MFA — FIDO2 security keys or Windows Hello for Business. SMS, TOTP, and push-based MFA are all interceptable by AiTM kits like N0va. This is the single most impactful control you can implement.
  • Deploy Conditional Access policies requiring compliant devices and approved locations for access to Microsoft 365 and cloud resources. Block legacy authentication protocols entirely.
  • Hunt for N0va indicators using the URL pattern above in proxy logs, DNS logs, and email security gateway logs. Expand hunting to include any authentication flow redirection to non-standard domains.
  • Review active OAuth grants in Microsoft 365 and Azure AD — identify any applications with unexpected permissions or recent consent grants from users in targeted departments.

Strategic Hardening

  • Implement just-in-time privileged access management to reduce standing admin exposure
  • Deploy session monitoring tools that flag anomalous token usage patterns, not just login anomalies
  • Conduct targeted phishing simulations that replicate AiTM techniques, not just credential harvest pages — your users need to recognize the difference between a fake login page and a real one being proxied
  • Establish a documented session revocation runbook so incident response teams can invalidate tokens across all identity providers within minutes, not hours

The N0va campaign underscores a reality that many security programs have yet to fully internalize: when attackers can authenticate as legitimate users using legitimate protocols, the distinction between 'authorized' and 'malicious' activity collapses. Defenders must shift from detecting malicious actions to detecting anomalous identities — and that requires instrumentation at the identity layer, not just the network and endpoint layers where we've traditionally invested.