As reported by Dark Reading, the emergence of the NovaCookies adversary-in-the-middle (AitM) phishing kit — priced at roughly $320 per month — represents another step in the full commoditization of session hijacking infrastructure. While the headline focuses on price and accessibility, the deeper story is about how the attacker economics have shifted to make session tokens, not passwords, the primary currency of initial access.

Threat Alert: While the headline focuses on price and accessibility, the deeper story is about how the attacker economics have shifted to make session tokens, not passwords, the primary currency of initial access.

Why Session Cookies Are the Real Prize

The security industry spent the last decade building MFA adoption, and for good reason — it neutralized the vast majority of credential-stuffing and spray attacks. But AitM phishing kits like NovaCookies don't care about credentials. They proxy the authentication flow in real time, capture the session cookie issued after MFA succeeds, and hand it to the attacker. The victim's password and second factor are irrelevant once the session token is in hand.

This is a critical mental model shift for defenders: MFA is not broken, but it is insufficient against proxy-based phishing when session management is weak. The authentication event succeeds. The problem is what happens next — the token persists, travels, and grants access without further challenge.

The attack surface is no longer the login page. It's the session lifecycle — issuance, persistence, revocation, and device binding.

Who Is Most Exposed

Why Session Cookies Are the Real Prize
Organizations with MFA but no Conditional Access: If your only identity control is "require MFA," AitM kits bypass it by design.
BYOD and unmanaged device environments: Session cookies stolen from personal devices have no device trust signal to invalidate them.
SMBs without dedicated SecOps: The $320/month price point puts enterprise-grade phishing infrastructure within reach of financially motivated criminals targeting smaller organizations that lack 24/7 monitoring.
Organizations with long session lifetimes: Microsoft 365 refresh tokens can remain valid for extended periods unless proactive revocation and sign-in frequency policies are enforced.

The Democratization Problem

The pricing model matters more than it appears. When AitM capability required custom development, it was limited to sophisticated operators. At $320/month with a managed interface, NovaCookies lowers the barrier to the point where low-skill threat actors — including those running Business Email Compromise (BEC) campaigns — can deploy session-stealing phishing at scale. This expands the population of attackers capable of MFA bypass by an order of magnitude.

We should expect this capability to cascade downstream into ransomware affiliate playbooks. Initial access brokers who previously sold credentials will increasingly sell validated session tokens, and affiliates will consume them without needing to understand the underlying AitM infrastructure.

Beyond Credential Monitoring: What Defenders Must Change

Traditional phishing defenses — URL filtering, password reset workflows, user training to "look for the padlock" — are necessary but insufficient against AitM. The proxy infrastructure often uses legitimate-looking domains with valid TLS certificates, making visual detection by end users nearly impossible.

Defenders need to assume that some users will be phished successfully and that session tokens will be stolen. The question becomes: how quickly can you detect and invalidate a stolen session?

Shield53 Recommendations

  • Enforce Conditional Access with device trust: Require compliant or Entra ID-joined devices for access to sensitive workloads. Session tokens stolen from non-compliant or unknown devices should fail device-bound policies.
  • Implement Continuous Access Evaluation (CAE): CAE enables near-real-time enforcement of policy changes and session revocation, reducing the window of opportunity for a stolen token from hours to minutes.
  • Configure sign-in frequency and session lifetimes: Don't rely on defaults. Set aggressive reauthentication intervals for privileged users and sensitive applications.
  • Monitor for impossible travel and atypical session patterns: Stolen sessions often originate from geographies or IP ranges inconsistent with the user's normal behavior. Deploy Microsoft Entra anomaly detection or equivalent UEBA.
  • Deploy FIDO2 security keys for high-risk accounts: Phishing-resistant authentication that cryptographically binds to the legitimate origin domain cannot be proxied by AitM kits. This is the strongest available mitigation.
  • Hunt for token reuse in logs: Look for the same session ID or refresh token appearing across multiple IP addresses, ASNs, or geographies within a short time window. This is a strong indicator of session theft.
  • Block legacy authentication: Ensure legacy protocols that bypass Conditional Access are fully disabled at the tenant level.
  • Train users on FIDO2, not URL spotting: Redirect security awareness efforts toward phishing-resistant authentication enrollment rather than expecting users to detect sophisticated proxy phishing pages.

The NovaCookies kit is not a novel technique — AitM phishing has been observed since at least 2022 with kits like EvilProxy and Modlishka. What's changing is the economics. As session-stealing infrastructure becomes a subscription product, the defensive posture must evolve from asking "did the user authenticate correctly?" to asking "is this session still trustworthy?" The organizations that make that shift will weather this wave. Those still treating MFA as the finish line will not.