NovaCookies At Scale: Inside The $320 Phishing Service Targeting Hundreds Of Organizations
By Shachar Gritzman, Senior Security Researcher, Island.
The NovaCookies phishing service is a commercial adversary-in-the-middle (AiTM) service that relays Microsoft 365 sign-ins to capture authenticated sessions. Meanwhile, trusted delivery chains, Microsoft and Google redirect hops, disposable infrastructure, and adaptive anti-analysis controls help its campaigns reach the lure.
Executive Summary
Advertised at $320 a month, the NovaCookies phishing service packages real-time Microsoft 365 session theft as a subscription phishing service.
Campaign artifacts reviewed across our research sources show hundreds of organizations targeted across multiple regions. Meanwhile, the service’s infrastructure expanded sharply from mid-May and continued appearing through August 2026.
Nearly 90% of the organizations in the reviewed set were associated with lures hosted on .vu domains. In addition, a companion IOC release documents 755 domains assessed as dedicated malicious infrastructure.
Delivery methods varied across campaigns. Observed campaigns used genuine DocuSign envelopes to carry counterfeit document-share lures. Some clicks were also routed through legitimate Microsoft or Google sign-in endpoints as redirect hops before reaching the kit.
Therefore, the message, document service, and redirect can appear trustworthy until the browser reaches attacker-controlled infrastructure.
Behind the lure, NovaCookies relays Microsoft 365 authentication through attacker-controlled infrastructure. This allows it to capture the resulting session after password and MFA submission.
It combines proof of work, short-lived context binding, and browser checks to resist automated analysis without making its lures unreachable. Phishing-resistant authentication remains the structural defense.
Campaigns that look unrelated can be deployments of the same rented product. Therefore, blocking yesterday’s domain removes only one disposable part of the operation.
- Figure 1: Simplified NovaCookies campaign flow. Delivery, lure, and redirect techniques varied across campaigns before converging on visitor scoring, a live Microsoft 365 relay, and session-cookie theft.
Evidence Of The NovaCookies Commercial Model
Evidence of that commercial model was designed to disappear.
An account advertising NovaCookies sent a one-time Telegram image that it said showed one of its customers. The interface offered cookie-link purchases, orders, a wallet, redirect services, and support.
It looked less like a phishing kit than a subscription business.
- Figure 2: Left: a one-time Telegram image sent by the account advertising NovaCookies. The sender described it as a profile belonging to a buyer. Identifiers are redacted, and the image does not establish an order or payment. Right: additional material from the advertising account listing prices of $320 per month or $200 for fourteen days, with domains, hosting and redirect services described as part of the package.
The left-hand image was sent as a disappearing Telegram photo by the account advertising NovaCookies.
The sender said it showed a buyer profile in the NovaCookies panel, labeled as a customer. We redacted all identifying details.
Public posts associated with the account shown in that profile included phishing administration panels containing credential and session data. Those posts indicate phishing activity.
However, they do not establish a NovaCookies purchase. We found no order, payment, or transaction that independently confirmed the seller’s claim.
NovaCookies Phishing Sold As A Service
The account quoted $320 for a month of access or $200 for fourteen days. It said the package included domains, hosting, and Google or Microsoft-branded redirect options.
The prices were captured directly. In addition, both advertised redirect variants appear in observed campaign infrastructure, consistent with the seller’s description.
The economics are straightforward.
Building and maintaining an adversary-in-the-middle relay takes specialist work. Renting one lowers that barrier and gives buyers a maintained sign-in flow, infrastructure rotation, and an operator interface.
Therefore, what appears from the outside as a series of unrelated phishing incidents can be many customers using the same product.
NovaCookies Infrastructure Scale-Up Began In Mid-May
The shape changed in mid-May 2026.
Domain registrations accelerated, while first-seen dates across our research sources reached their highest level in June. New infrastructure also continued to appear through August.
Proofpoint reported NovaCookies campaign activity increasing from March through May before declining in June.
However, our dataset combines domain-registration dates with first-seen dates from public campaign artifacts and our own collection. It measures infrastructure visibility, not email or campaign volume.
Therefore, the two findings reflect different research vantage points.
- Figure 3: NovaCookies infrastructure activity over time.
However, our dataset uses a different measurement. It combines domain-registration dates with first-seen dates from public campaign artifacts and our own collection.
Therefore, it measures infrastructure visibility, not email or campaign volume.
The two findings reflect different research vantage points rather than necessarily conflicting activity trends.
NovaCookies Uses Brand-Themed Domains And Mixed-Case Lure Paths
Many NovaCookies domains borrow recognizable company names. They then mutate them with inserted letters, dropped characters, or long concatenations under .vu.
Four examples from the dedicated attacker-infrastructure release show the pattern:
Across the broader IOC set, some hostnames append an abbreviation, combine an acronym with a long-form company name, or stack multiple recognizable names into one label.
The complete set is available in the companion GitHub release.
Lure Infrastructure Does Not Mean Company Compromise
These names are lure infrastructure, not evidence that the referenced companies were compromised.
Nor should the company embedded in a hostname automatically be treated as the recipient. Across the corpus, the borrowed name and the targeted organization were not reliably the same.
Mixed-Case NovaCookies Lure Paths
NovaCookies builds its lure URLs around document-sharing language.
Observed paths begin with alternating-case labels such as PwPt-sHaRe, Ms36-AcCeSs, and ClOd-ViEw.
These combine shortened references to familiar cloud products with actions such as share, access, and view.
Each label is followed by a long changing token and a shorter final token. Therefore, individual links can differ while retaining the same recognizable structure.
The mixed casing is a useful campaign fingerprint. However, it is not proof of the scanner resistance described later in this report.
Search and scan systems may normalize case. In addition, capitalization alone does not explain why a replay fails.
Analysts should therefore treat the shape as contextual evidence alongside the domain, page behavior, and anti-analysis layers rather than as a standalone signature.
An Envelope Inside An Envelope
The strongest delivery chain we observed began inside a service the recipient already trusted: DocuSign.
The email was a genuine DocuSign notification. It opened a genuine Docusign envelope in the real viewer.
Everything at that layer could pass normal sender-authentication and reputation checks.
However, the document inside the envelope was counterfeit.
Styled as a DocuSign share notice, it claimed that an accounting department had shared a remittance-advice PDF and invited the recipient to open it.
The malicious destination sat inside the document, below the layer most mail security products inspect.
- Figure 4: A genuine DocuSign envelope carried a counterfeit share notice whose malicious destination sat inside the document.
NovaCookies Uses A Microsoft OAuth Redirect Technique
NovaCookies used a documented OAuth error-redirect technique Microsoft described in March 2026.
The chain begins with an application registered in an attacker-controlled tenant, whose redirect URI points at attacker infrastructure. It also uses a genuine Microsoft authorization URL designed to fail silent authentication.
Entra then sends the browser from its own domain to that pre-registered hop. No token is issued, and no consent prompt appears.
A smaller number of chains used Google’s sign-in endpoint for the same redirection role. This supports the seller’s advertised Microsoft and Google redirect options.
Unlike a classic open redirect, the destination must already be registered to the application.
The value is the trusted starting domain. In addition, the application IDs give identity providers another disruption point when malicious registrations are reported.
Each Hop Can Appear Legitimate
That chain is effective because each hop feels reasonable in isolation: a genuine document service, an identity-provider response, then a familiar sign-in page.
Trust fails only at the final destination.
DocuSign and Microsoft were not compromised in this chain. Instead, the chain used their services as delivery and redirection layers.
It is a reminder that a trusted origin can still carry an untrusted journey.
Other NovaCookies delivery chains took a different route.
We observed links passing through legitimate websites that appeared to have been compromised. We also observed legitimate online services abused to host or redirect malicious content.
These intermediate hops kept the final phishing domain out of the original message. They also allowed the journey to begin on an established domain before sending the browser to NovaCookies infrastructure.
NovaCookies Session Theft Beyond The Credential Page
NovaCookies operates as a live adversary-in-the-middle relay.
The target sees a Microsoft 365 sign-in experience, while the service passes the authentication exchange to Microsoft in real time.
The service relays the password and MFA prompts step by step. Once Microsoft issues an authenticated session, the proxy can capture the session cookie that represents it.
The NovaCookies Kit Is Purpose-Built
The bundles show this is purpose-built rather than generic.
The kit carries dedicated handling for authenticator push approval, authenticator one-time codes, and SMS codes. It uses Microsoft’s own internal names for those methods.
In addition, it has separate error states for a rejected password, a rejected code, and a rejected SMS.
A relay written against a generic login form would not mirror Entra’s method taxonomy.
It also counts submission attempts, which is consistent with the repeated-password behavior described below.
Why Phishing-Resistant Authentication Matters
This is why ordinary one-time codes and push approvals do not solve the problem on their own.
The victim is completing a real authentication, just through an attacker-controlled intermediary.
Phishing-resistant authentication changes the geometry.
Passkeys, FIDO2 security keys, and other origin-bound credentials will not authenticate to the wrong site. Therefore, the relay cannot complete the same exchange.
- Figure 5: A preserved NovaCookies lure rendered a familiar Microsoft 365 sign-in experience. The address bar is retained to show the published IOC domain and mixed-case lure path; only the unique lure token is redacted.
NovaCookies Uses Layered Scanner Resistance, Not Scanner-Proof Lures
Cloudflare is the visible front gate, but it is not the whole anti-analysis story.
Its presence alone is not evidence of NovaCookies.
The service layers browser checks with client-side proof of work, short-lived context binding, and runtime inspection checks.
Each layer frustrates a different kind of automated or delayed replay.
NovaCookies Scores Visitors
Recovering the client bundles changes the picture from a checklist to something closer to a fraud engine.
The kit does not simply pass or fail a visitor.
It scores the browser, and it weighs those signals against whether it has seen human behaviour. It will forgive a failed check when interaction looks genuine and skip its more expensive checks entirely for a visitor that already looks human.
Admission is a confidence judgement with a fallback, not a boundary.
The scoring draws on interaction patterns, device and browser characteristics, automation markers, and attempts to open developer tools or inspect the page.
Buyers Can Configure NovaCookies Anti-Analysis Controls
These controls are exposed as buyer-configurable settings, with tunable intervals, callbacks, and strict or development presets.
Each deployment can therefore use a different combination of anti-analysis controls.
This makes the kit’s resistance to analysis a configurable product capability rather than a fixed sequence of checks.
- Figure 6: Representative controls in NovaCookies’ configurable anti-analysis stack. Deployments may combine them differently when deciding whether to render the lure.
Debugger Timing Adds Another Anti-Analysis Signal
One example is debugger timing, a long-documented anti-debugging technique.
The client measures execution across a debugger statement. A pause when developer tools are open can contribute to its decision to withhold the lure:
This timing result becomes one more signal in the kit’s configurable decision about whether to render the lure.
Scanner-Resistant Does Not Mean Scanner-Proof
The practical result depends on the visitor.
A no-JavaScript request may stop at the outer gate. A browser can progress further.
Meanwhile, a delayed replay or changed environment may fail.
Full-browser public scanners have also captured the lure on some occasions.
Therefore, “scanner-resistant” is the defensible description. Claims that scanners cannot reach these pages would overstate the evidence.
NovaCookies Targeting Spanned Regions And Sectors
Review of our research campaign artifacts showed a geographically broad operation.
Approximately nine in ten observed organizations appeared in the large .vu campaign wave.
That concentration makes .vu an important feature of the current operation. However, it is not a permanent identity. NovaCookies has used multiple domain families and hosting patterns over time.
The observed footprint was geographically broad.
About half of the distinct organizations represented in the reviewed campaign artifacts were associated with the United States.
Meanwhile, the United Kingdom, Canada, Germany, Israel, and the United Arab Emirates formed smaller visible concentrations.
These findings indicate apparent targeting, not confirmed interaction or compromise.
- Figure 7: Share of distinct organizations represented in reviewed NovaCookies campaign artifacts across our research sources. Percentages show inferred target geography, not attacker location, confirmed compromise or a complete victim census.
Targeting Does Not Mean Compromise
The reviewed artifacts provide a conservative minimum for NovaCookies targeting across our research sources, not a complete census.
An organization’s appearance in those artifacts indicates targeting, not interaction or compromise.
Therefore, confirming credential submission or session theft requires separate evidence.
The NovaCookies Operator Interface Brands It As “Nova Cookies”
The kit’s operator-facing dashboard supplies its most memorable piece of branding: a circular “Nova Cookies” badge built around a cookie, alongside the line “Secured by Nova Systems.”
The name is unusually candid.
Passwords open the door, but session cookies are the asset that lets an AiTM operator reuse a completed Microsoft 365 authentication.
- Figure 8: The operator-facing login displayed Nova Cookies branding.
Repeated Password Submissions May Increase Yield
The credential flow also appeared tuned for yield.
In one preserved observation, the same page accepted repeated password submissions before advancing.
That behavior is consistent with collecting more than one candidate password.
However, we did not capture a definitive error message proving that this is a fixed product rule. Therefore, we report the behavior as observed rather than assigning an exact mechanism.
A Shared Product Does Not Imply One Threat Actor
The shared product does not imply a single threat actor.
Different buyers can bring different targets, domains, registrars, and campaign schedules while leaving the same product fingerprints.
Therefore, attribution must separate the service, the account advertising it, and the individual customer using it.
What Defenders Should Do Now
- Put phishing-resistant authentication on high-value accounts. Passkeys, FIDO2 security keys, and other origin-bound credentials structurally interrupt an AiTM relay.
- Detect the product, not only yesterday’s domains. Correlate the current .vu lure shape, brand-themed hostname mutations, mixed-case document-action tokens, and redirect chains into Microsoft-style relays. Treat any one feature as weak evidence. Instead, combine them with browser and page behavior, reputation, and the versioned IOC release.
- Keep dedicated infrastructure separate from potentially compromised hosts. Block attacker-controlled domains at the apex where appropriate. However, use URL- or path-level controls and investigation for legitimate sites that may have been abused.
- Assume the delivery path may be trusted until its final hop. Inspect links inside document viewers and collaboration platforms. In addition, do not depend on referrer data to reconstruct how a user arrived.
- Treat a completed relay as possible session theft. Revoke sessions, reset credentials, inspect identity-provider sign-ins, and review new MFA methods, OAuth grants, forwarding rules, and inbox rules.
NovaCookies Research Limits
- Telegram material records claims made by an account advertising NovaCookies. It does not establish the seller’s identity or independently confirm any customer, order, payment, or completed purchase. Identifying details have been withheld.
- Campaign artifacts across our research sources indicate targeting and infrastructure association, not successful delivery or account compromise. Geographic and sector findings describe the reviewed dataset, not a complete victim census.
- Short-lived links and differences between deployments prevented repeatable testing of every access condition. Scanner findings reflect preserved captures and controlled observations, not a claim that every deployment defeats every scanner.
NovaCookies Versioned Indicators And Disclosure
The companion IOC release publishes 755 domains.
The list is sanitized. It contains no victim data, personalized lure links, Telegram identities, wallet addresses, or internal telemetry.
GitHub IOC repository: https://github.com/island-io/island-security-research-artifacts/tree/main/novacookies.
Indicators are evidence with an expiration date.
NovaCookies rotates infrastructure, and legitimate domains can be abused.
Therefore, consumers should retain the package version, review the handling notes, and combine IOCs with behavior-based detections.
NovaCookies’ infrastructure is designed to vanish. Its service model is built to persist.
Defenders will catch up faster when they investigate the product behind the domains, not only the domain that happened to be live yesterday.
The Browser Is Where The NovaCookies Chain Becomes One Session
NovaCookies is built so each hop can look legitimate on its own: a trusted delivery service, an identity-provider redirect, then a familiar sign-in page.
Those pieces often land in different tools.
The browser is where they become a single event.
That is the layer Island Enterprise Browser is built to control.
It can apply policy as the page renders and restrict sensitive actions on unfamiliar or unmanaged destinations.
These controls operate inside the browser session rather than after an analyst reconstructs the path across separate tools.
Phishing-resistant authentication remains the structural defense.
Browser-level control adds enforcement after the click.
Stay Informed With Cyber News Live
Cyber threats are constantly evolving, and staying informed is critical to protecting your organization.
Follow Cyber News Live for the latest cybersecurity news, threat intelligence, expert analysis, and practical guidance to help strengthen your cyber defenses.