As reported by The Hacker News, the NovaCookies adversary-in-the-middle (AitM) phishing kit represents a notable evolution in the phishing-as-a-service (PhaaS) economy — one that weaponizes trust in legitimate document-signing platforms to harvest authenticated session tokens from Microsoft 365, Okta, and Entra-federated identity providers.

Threat Alert: The malicious payload lives behind the legitimate Docusign document link — meaning organizations must inspect the destination of document-share URLs, not just the email envelope itself.

Why This Campaign Is Hard to Stop

The most significant tactical shift here is the abuse of genuine Docusign envelopes as the initial lure. Because the email originates from Docusign's actual infrastructure, it passes SPF, DKIM, and DMARC authentication checks. Secure email gateways and brand-impersonation filters that rely on sender reputation or header analysis will see nothing wrong. The malicious payload lives behind the legitimate Docusign document link — meaning organizations must inspect the destination of document-share URLs, not just the email envelope itself.

The message, document service, and redirect chain all appear trustworthy until the browser reaches attacker-controlled infrastructure. By that point, traditional email security has already waved the message through.

Session Theft: Bypassing MFA Without Breaking It

NovaCookies follows the now well-established AitM pattern: the victim authenticates against what appears to be Microsoft's login page, but the kit proxies credentials and MFA codes in real time to the real identity provider, then intercepts the resulting session cookie. MFA is not bypassed — it is completed by the attacker through the proxy. This means that conditional access policies keyed solely on "MFA satisfied" or "compliant device" are insufficient if they do not also evaluate session token provenance, impossible-travel signals, and token issuance anomalies.

Proofpoint's assessment that NovaCookies is a variant of the Sneaky 2FA kit is worth noting. The shift from affiliate-hosted infrastructure to a fully managed PhaaS model means the operator controls the phishing domains, redirect hops, and backend — lowering the technical barrier for affiliates and centralizing infrastructure that is harder to attribute and disrupt.

Who Is Most at Risk

Session Theft: Bypassing MFA Without Breaking It
Organizations federating Entra ID through GoDaddy — the kit includes dedicated flows for these configurations, which are common in SMB and mid-market deployments.
Okta tenants — the expansion beyond Microsoft 365 broadens the attack surface significantly.
Finance, accounting, and AP departments — the remittance-advice lure is tailored to roles that routinely process payment documents via Docusign.
Organizations without session token revocation automation — once a token is stolen, the window for lateral movement depends entirely on how quickly defenders can invalidate active sessions.

Shield53 Recommendations

Immediate Actions

  • Deploy or tune URL rewrites and time-of-click protection for Docusign and similar e-signature links. Inspect the final redirect destination, not just the initial envelope URL. Block redirects to .vu domains and domains exhibiting alternating-case URL patterns (e.g., PwPt-sHaRe, Ms36-AcCeSs).
  • Enable continuous access evaluation (CAE) in Microsoft Entra ID for supported applications. CAE can revoke sessions in near real time when risk signals are detected, shrinking the post-theft window from hours to minutes.
  • Implement session token binding and token protection policies where available. Entra ID token protection ties access tokens to device claims, making stolen tokens unusable on attacker infrastructure.
  • Configure conditional access with impossible-travel and unfamiliar-location signals as session-level risk conditions, not just sign-in risk. AitM tokens often originate from infrastructure geographically inconsistent with the user's typical patterns.
  • Block or quarantine Docusign emails containing links to document-share destinations on newly registered domains or domains with no prior organizational communication history.

Detection Guidance

  • Monitor Entra ID and Okta sign-in logs for token issuance events not preceded by an interactive authentication event from the same IP — this can indicate a proxied session being replayed.
  • Alert on session tokens presented from IP ranges associated with cloud hosting providers when the user's prior authentication originated from a corporate or residential IP.
  • Correlate Docusign envelope-open events with subsequent Microsoft 365 or Okta sign-ins from new geolocations within a short time window (under 30 minutes).

Strategic Posture

The NovaCookies campaign underscores a structural problem: email security that trusts authenticated senders cannot protect against threats that are the authenticated sender. Docusign, DocSend, SharePoint, and Google Drive share links are all viable channels for this technique. Organizations must move beyond sender-reputation models and adopt destination-analysis, behavioral session monitoring, and rapid token revocation as core controls. Treat every document-share link as a potential redirect chain until proven otherwise.