A phishing-as-a-service platform called NovaCookies is selling full Microsoft 365 account takeover as a $320-per-month subscription, and hundreds of organizations across the United States, United Kingdom, Canada, Germany, Israel, and the UAE have already been targeted. The kit was discovered by Island, an enterprise browser security company, with corroborating analysis from Proofpoint. What makes NovaCookies particularly dangerous is its attack chain: it starts with a real email from DocuSign’s own infrastructure — not a spoofed lookalike — sharing a document that embeds the malicious payload below the layer most email security tools inspect. One documented lure posed as an accounting department sharing a remittance-advice PDF.
Once a victim clicks the link, NovaCookies acts as an adversary-in-the-middle relay, proxying the real Microsoft 365 login page and intercepting the victim’s credentials, session cookies, and MFA codes in real time. The attacker gets immediate account access. Because each step in the chain looks legitimate in isolation — a real DocuSign email, a real identity-provider redirect, a convincing login page — perimeter tools cannot assemble the full picture. Lure domains frequently use the .vu top-level domain and deliberately alternating-case URL labels such as PwPt-sHaRe or Ms36-AcCeSS, which can serve as detection signals.
How to check if you’re affected
Affected products include Microsoft 365 accounts, as well as Okta and Entra federated services. If you received a DocuSign document notification recently that prompted a Microsoft, Okta, or Entra sign-in, review your Microsoft 365 sign-in logs at mysignins.microsoft.com for unfamiliar sessions or locations. MFA alone does not protect against NovaCookies — the kit intercepts codes in real time. Organizations should enable Conditional Access policies requiring compliant devices and consider phishing-resistant MFA (FIDO2/passkeys) as the most effective defense.