'NovaCookies' Phishing Kit Targets Microsoft 365 Sessions for $320 a Month

A new adversary-in-the-middle (AitM) phishing kit, dubbed 'NovaCookies,' is being offered for $320 per month, according to a report by Dark Reading. The service is designed to steal Microsoft 365 session cookies, allowing attackers to bypass multi-factor authentication (MFA) and gain persistent access to victim accounts.

The kit operates as a phishing-as-a-service (PhaaS) platform, providing a low-cost, easy-to-use interface for cybercriminals. By intercepting authentication tokens, NovaCookies enables attackers to hijack active sessions without needing to obtain passwords or MFA codes directly. This approach significantly lowers the technical barrier for launching credential theft and session hijacking attacks.

While the report does not specify the exact distribution channels or the identity of the operators, it highlights the growing trend of commoditized phishing tools that target cloud-based productivity suites. Microsoft 365 is a prime target due to its widespread enterprise adoption and the sensitive data it hosts.

The service is particularly concerning because it can steal more than just credentials. Session cookies can provide access to emails, files, and other corporate resources, potentially leading to data breaches, financial fraud, or further lateral movement within an organization.

As of the report's publication, there is no indication of a specific vulnerability being exploited; instead, the kit relies on social engineering to trick users into visiting malicious sites that proxy authentication requests. Organizations are advised to implement robust phishing defenses and monitor for unusual session activity.