NovaCookies Kit Enables $320 Microsoft 365 Session Hijacks

Introduction

The economics of cybercrime continue to shift in favor of attackers. What once required advanced technical knowledge, custom infrastructure, and a hefty budget can now be rented on a monthly basis for the price of a family dinner out. A new phishing toolkit known as NovaCookies is a prime example of this disturbing trend, offering adversary-in-the-middle (AitM) capabilities tailored specifically to Microsoft 365 environments.

For a subscription fee of $320 per month, buyers of the NovaCookies kit can launch phishing campaigns that do far more than harvest passwords. They can capture authenticated session cookies, effectively bypassing multi-factor authentication and walking straight into corporate inboxes, cloud drives, and collaboration tools. This development highlights a growing challenge for organizations that believe they have already secured their identities with modern authentication controls.

What NovaCookies Brings to the Underground Market

NovaCookies is being marketed in private cybercrime channels as a turnkey AitM phishing service. Instead of relying on traditional credential capture alone, the kit acts as a man-in-the-middle proxy between the victim and the legitimate Microsoft 365 login page. When a user enters their credentials and completes any required authentication steps, the attacker silently records the resulting session cookie in real time.

That session cookie is the real prize. With it, an attacker can replay the authenticated session from their own machine, gaining access to the victim's mailbox, OneDrive, SharePoint, Teams, and any connected third-party applications without ever needing to know the password or trigger additional authentication prompts. This effectively neutralizes one of the most widely recommended defenses of the past decade.

Why the $320 Price Tag Matters

The relatively low cost of NovaCookies is what makes it especially dangerous. Historically, building a reliable AitM phishing operation required significant investment in infrastructure, reverse proxy servers, TLS certificates, and obfuscation techniques to evade detection. Kits like Evilginx popularized the approach, but operators still needed considerable know-how to deploy and maintain them.

By packaging everything into a managed subscription, NovaCookies dramatically lowers the technical barrier to entry. Threat actors who previously lacked the skills to run advanced phishing campaigns can now simply sign up, follow a few steps, and start stealing active sessions. The subscription model also encourages persistence, giving attackers continuous access to updates, infrastructure, and customer support in exchange for steady monthly revenue.

The Broader Shift Toward Identity-Focused Attacks

NovaCookies is not an isolated case. It represents a wider movement across the cybercrime ecosystem away from malware-based intrusions and toward identity-based attacks. Stealing a valid session token is often cleaner, quieter, and harder to detect than deploying a backdoor or ransomware payload. Once inside, attackers can move laterally, access sensitive data, and establish persistence through legitimate cloud applications.

Microsoft 365 remains a high-value target because of its ubiquity in the enterprise world. A single compromised mailbox can expose internal communications, customer data, financial documents, and authentication secrets for connected services. From there, attackers can pivot into supply chain attacks, business email compromise schemes, or even full account takeovers across other platforms that rely on the same identity provider.

Defensive Challenges for Security Teams

Traditional security controls often struggle against AitM phishing. Multi-factor authentication, long considered a silver bullet, can be bypassed when attackers proxy the entire authentication flow in real time. Security awareness training helps, but even vigilant users can be deceived by convincing phishing pages that mirror legitimate Microsoft login portals.

Security teams need to adopt a layered defense strategy that goes beyond passwords and MFA. Monitoring for anomalous session activity, enforcing conditional access policies, requiring device compliance, and analyzing sign-in behavior for impossible travel or unusual locations are all critical. Organizations should also consider phishing-resistant authentication methods, such as FIDO2 hardware keys, which are resistant to AitM relay attacks by design.

Indicators and Detection Opportunities

While NovaCookies and similar kits are designed to blend in with normal traffic, defenders can look for subtle signs of compromise. Unusual sign-in patterns, sessions originating from unfamiliar IP ranges or ASNs, and the presence of suspicious reverse proxy infrastructure in web server logs can all hint at an active AitM campaign.

Email security gateways that inspect links in real time can also help, particularly when they detect proxied requests to known Microsoft authentication endpoints from non-Microsoft infrastructure. Threat intelligence teams should actively track infrastructure associated with AitM kits and incorporate those indicators into blocklists and detection rules.

Conclusion

NovaCookies is another reminder that cybercriminals are professionalizing their operations at scale. By offering powerful AitM capabilities for just a few hundred dollars a month, the kit makes advanced session theft accessible to a much wider pool of attackers. Organizations that rely on Microsoft 365 must recognize that traditional defenses alone are no longer enough. Investing in phishing-resistant authentication, tightening session management, and continuously monitoring for identity-based threats are now essential components of any serious security program. As the threat landscape evolves, platforms like Grivyonx Cloud are empowering businesses with AI-driven automation and advanced cybersecurity intelligence to detect, respond to, and neutralize identity-based attacks before they escalate into full-blown breaches.