NovaCookies Phishing Kit Steals Microsoft 365 Sessions

Researchers disclosed NovaCookies, an adversary-in-the-middle phishing toolkit that proxies Microsoft 365 sign-ins and captures authenticated sessions. Island characterized the $320/month service as a subscription-based phishing platform. The toolkit abuses genuine Docusign notifications to redirect victims.