NovaCookies AitM Toolkit Abuses Docusign Notifications to Hijack Microsoft 365 Sessions

Cybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies. According to a report shared with The Hacker News ahead of publication, Island characterized the service as a subscription-based phishing platform costing $320 per month.

The NovaCookies toolkit is used as a proxy to redirect Microsoft 365 sign-ins. Researchers allege that the campaign abuses genuine Docusign notifications as a delivery mechanism to facilitate the attack. By leveraging legitimate Docusign notifications, the attackers aim to redirect Microsoft 365 sign-ins and capture authenticated sessions in the process.

The report indicates that the toolkit functions as a proxy, sitting between the victim and the legitimate service, allowing attackers to intercept authentication tokens and session cookies. This enables session hijacking without needing to directly crack credentials, as the attacker gains access to the already-authenticated session.

Microsoft 365 users are the primary targets of these campaigns. The use of genuine Docusign notifications adds a layer of legitimacy to the phishing attempts, potentially increasing the likelihood of user interaction. Island researchers have highlighted the sophistication of the AitM approach in bypassing traditional security controls.

As of the report publication, no direct software patch has been issued by Microsoft or Docusign to address the underlying protocol abuse. The focus of mitigation is on user education, MFA configuration, and session monitoring.