NovaCookies rents real-time Microsoft 365 session theft for $320 a month

The kit sits inside a real login. The victim types the password into a page the operator is proxying and approves the second factor, Microsoft issues a session against a genuine credential, and the operator keeps the cookie ^[3]. The infrastructure uses short-lived context binding and runtime inspection so email scanners never see the live page, and no part of the chain needs malware or a vulnerability ^[7]. According to Island's Shachar Gritzman, the initial authentication succeeds normally, without malware, an exploit, or a burst of failed logins, so the sign-in event may look ordinary ^[8].

Island dates the growth in NovaCookies infrastructure to a sharp expansion from mid-May that continued through August ^[5]. The kit is priced like software. Two hundred dollars for fourteen days is about $14.29 a day, against about $10.67 a day on the $320 month ^[4]. The buyer gets a maintained sign-in flow, rotating infrastructure and an operator interface ^[10], and Gritzman notes that renting lowers the barrier substantially without making every buyer sophisticated or every campaign successful ^[9].

The second kit in the report, Mirage2FA, comes with figures from ANY.RUN covering 23 months, September 2024 to July 2026 ^[12][5]. The campaign is linked to 3,518 organization email domains and 9,426 targeted addresses, about 2.7 mailboxes per organization ^[12][13][3]. Of those addresses, 4,532 were potentially compromised, roughly 48 percent ^[13].

The event totals do not match the summary attached to them. Session cookie theft, at 4,561 of 9,332 recorded events, is 48.9 percent ^[14][1], and the write-up describes it as more than half of everything recorded ^[15]. The three named categories sum to 8,944, leaving 388 recorded events outside them ^[2]. Cookie theft is still the largest single category, ahead of 3,044 password or second-factor compromises ^[14].

ANY.RUN attaches a caveat to all of it: every victim and campaign-scale number is an approximate estimate drawn from an available dataset, representing potential impact rather than independently confirmed compromise ^[11]. The same piece says customers at one of the most security-literate software companies in the industry were hit within the last month, and it does not name the company ^[18].

MFA still stops credential replay, and neither kit attacks it: both take what it issues ^[3][16]. That puts the detection problem on the session, because the identity provider logs a normal sign-in ^[8].