NovaCookies: $320 a month buys a session-theft rig that rides real Docusign mail

One attack chain bypasses sender-authentication and reputation checks by exploiting the fact that the email is a genuine Docusign notification; what is malicious is the document shared via the service.

Island: the lure was styled as a Docusign share notice claiming an accounting department had shared a remittance-advice PDF, and the malicious destination sat inside the document, below the layer most mail security products inspect.

The commercial offering includes anti-analysis checks before serving the bogus Microsoft 365 login form, including a Cloudflare gate and a mechanism to detect execution passes associated with debugging tools.

According to Island, built-in evasion includes short-lived context binding and runtime inspection to make lures resistant to email scanners.

Proofpoint assesses NovaCookies to be a variant of the Sneaky 2FA phishing kit, and says the variant includes dedicated flows for other identity providers, including Okta and Entra domains federated to GoDaddy.

Abhishek Agrawal, co-founder and CEO of Material Security, said the kit steals the authenticated session itself, so MFA does not factor in at all, and once the session is captured the attacker is inside the account for as long as that session stays valid, which can be a long time.

Island is an enterprise browser maker, and Shachar Gritzman is a senior security researcher there.

NovaCookies has at least 755 domains as part of its dedicated infrastructure.

Gritzman wrote that the campaign infrastructure expanded sharply from mid-May and continued to appear through August.

The attack employs an OAuth error-redirect technique detailed by Microsoft earlier in March to lead victims to attacker-controlled infrastructure.

Proofpoint: unlike Sneaky2FA, NovaCookies uses a fully managed phishing-as-a-service model in which affiliates pay to use the platform and infrastructure is hosted centrally by the operator rather than by each affiliate.

NovaCookies is advertised via Telegram, which is also used as infrastructure to manage customer profiles, configure redirect services and contact support.

Many NovaCookies lure domains are hosted on the .vu domain, with phishing URLs featuring alternating-case labels such as PwPt-sHaRe, Ms36-AcCeSs and ClOd-ViEw.

Gritzman told Dark Reading the initial authentication can succeed normally, without malware, an exploit or a burst of failed logins, so the sign-in event may look ordinary.

Gritzman wrote that building and maintaining an AitM relay takes specialist work, and that renting one lowers that barrier and gives buyers a maintained sign-in flow, infrastructure rotation and an operator interface.

Gritzman said the service lowers the barrier substantially, though it does not make every buyer sophisticated or every campaign successful.

The monthly subscription price annualises to $3,840 a year.

The 14-day option works out at about $14.29 per day against about $10.67 per day on the monthly plan, roughly 34 percent more per day.

Island: NovaCookies is built so each hop can look legitimate on its own, a trusted delivery service, an identity-provider redirect, then a familiar sign-in page; those pieces often land in different tools, and the browser is where they become a single event.

Agrawal said the pivot to session theft is likely driven by passkeys and WebAuthn making credential theft harder, and that PhaaS operators are productizing it to meet demand.

With at least 755 dedicated domains against hundreds of targeted organizations, the operation registers more domains than it has targets, implying domains are consumed faster than victims are acquired.