Researchers have uncovered a new phishing-as-a-service platform named NovaCookies that exploits legitimate DocuSign notifications to harvest Microsoft 365 session tokens from victims.
Island, the security firm that identified the threat, describes NovaCookies as a subscription service priced at $320 per month. The toolkit functions as an adversary-in-the-middle (AitM) proxy, intercepting Microsoft 365 authentication flows to capture authenticated session cookies before users even realize they've been compromised.
The attack chain relies on social engineering built around genuine DocuSign emails. Threat actors send messages that mimic authentic DocuSign notifications, typically prompting recipients to "review" or "sign" documents. The emails contain links to attacker-controlled pages hosting the NovaCookies proxy. When targets click through and attempt to sign in with their Microsoft 365 credentials, the proxy captures their login requests, displays a legitimate Microsoft authentication interface, and harvests the resulting session tokens once authentication succeeds.
Unlike traditional phishing that simply tricks users into revealing passwords, NovaCookies captures session cookies directly. This approach bypasses multi-factor authentication defenses entirely. Even if an organization enforces MFA, attackers obtain valid, authenticated sessions that allow immediate access to Microsoft 365 services including Outlook, OneDrive, SharePoint, and Teams without requiring additional authentication steps.
The platform's subscription model indicates commercial-scale distribution. At $320 monthly, NovaCookies removes operational barriers for low-skilled threat actors. Operators need only create convincing lure emails and manage victim traffic through the proxy. The toolkit handles the technical complexity of session interception and cookie extraction.
DocuSign's legitimacy in enterprise workflows makes this vector particularly effective. Organizations rely heavily on DocuSign for contract management and document signatures. Recipients expect DocuSign emails regularly and lower their guard accordingly. Attackers exploit this familiarity to increase click-through rates on malicious links.
The NovaCookies discovery reflects a broader shift in phishing tactics away from credential harvesting toward session hijacking. AitM proxies have become increasingly prevalent in commercial phishing operations targeting enterprise identity systems. Previous notable AitM toolkits included Evilginx2 and OpenPhish, though NovaCookies demonstrates the commodification of this attack pattern.
Organizations face two distinct challenges with this threat. First, email filtering systems must identify and block NovaCookies phishing campaigns despite their use of legitimate DocuSign branding and notifications. Threat intelligence teams need indicators of compromise associated with known NovaCookies infrastructure to detect traffic destined for attacker-controlled proxy servers.
Second, endpoint and identity security controls require hardening against session theft. Standard password-based security fails entirely when attackers harvest valid session tokens. Organizations should implement continuous authentication mechanisms that detect impossible travel scenarios, unusual access patterns, or suspicious device fingerprints associated with stolen sessions.
Microsoft 365 defenders should prioritize deploying conditional access policies that flag authentication events from anomalous locations, unusual client applications, or unfamiliar devices. Session replay detection systems that identify reused tokens from different geographic locations or timezones can catch compromised sessions before attackers establish persistence.
The DocuSign notification angle highlights how attackers weaponize trust in legitimate platforms. Organizations cannot simply block all DocuSign emails without disrupting business processes. Instead, security teams must educate users on verifying URLs in DocuSign notifications and avoiding external links from document collaboration requests, opting instead to log directly into DocuSign through bookmarked URLs or official applications.