aviatrix logoAviatrix
Under Active Attack

Executive Summary

The N0va phishing campaign has emerged as a sophisticated threat targeting organizations across North America and Europe in 2026, focusing on government, technology, consulting, and healthcare sectors. Unlike traditional phishing attacks, N0va impersonates trusted business platforms including Microsoft Teams, SharePoint, OneDrive, DocuSign, and Google Drive, then guides victims through legitimate authentication flows to capture access and refresh tokens. Once successful, attackers abuse token-exchange mechanisms to establish SSO access across corporate resources, enabling access to email, files, and cloud applications without deploying obvious malware. The campaign's use of legitimate authentication processes and trusted brand impersonation makes detection challenging and can lead to significant financial losses, data exposure, operational disruption, and compliance violations.

This incident highlights the evolving sophistication of identity-based attacks that exploit trust in legitimate business platforms and authentication mechanisms, representing a growing trend where attackers move beyond traditional malware deployment to abuse valid business processes for initial access and persistence.

Why This Matters Now

Identity-based attacks like N0va are rapidly becoming the primary attack vector as organizations adopt cloud-first strategies, making traditional perimeter defenses insufficient against threats that abuse legitimate authentication flows and trusted business platforms.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

N0va uses legitimate authentication flows and impersonates trusted business platforms to capture access tokens rather than relying on malware, making it harder to detect through traditional security measures.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely constrain the N0va campaign's ability to pivot across cloud applications and exfiltrate data through lateral movement restrictions and egress controls. Segmentation policies could reduce the blast radius of compromised SSO tokens across business platforms.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: While the phishing attack itself may succeed, CNSF visibility would likely provide early detection of anomalous authentication patterns and token usage across cloud applications during the compromise sequence.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero trust segmentation would likely constrain the scope of SSO token privileges, limiting which cloud applications and resources the compromised identity could access even with valid authentication tokens.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely constrain lateral movement between cloud applications and services, limiting the attacker's ability to pivot freely across the connected business platform ecosystem using compromised tokens.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility could detect anomalous token refresh patterns and suspicious session behavior across different cloud platforms, potentially limiting the duration and scope of persistent access through behavioral analysis.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security controls would likely constrain data exfiltration by restricting outbound data flows and detecting unusual data access patterns, limiting the volume and types of sensitive information that could be extracted.

Impact (Mitigations)

While financial fraud and operational disruption may still occur, the constrained lateral movement and limited data access scope would likely reduce the overall impact magnitude and accelerate recovery through contained blast radius.

Impact at a Glance

Affected Business Functions

  • Identity and Access Management
  • Email and Collaboration Systems
  • Cloud Applications and Data Storage
  • Single Sign-On (SSO) Services
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: $75,000

Data Exposure

Compromised employee credentials and SSO tokens providing access to corporate email, cloud storage (OneDrive, SharePoint, Google Drive), collaboration platforms (Teams, Zoom), and document signing systems (DocuSign, Adobe Sign). Potential exposure of customer records, employee information, intellectual property, and confidential business communications across government, technology, consulting, and healthcare sectors.

Recommended Actions

  • • Implement Zero Trust segmentation with identity-based policies to limit SSO token abuse and restrict lateral movement across cloud applications and services
  • • Deploy egress security controls with FQDN filtering and policy enforcement to detect and block unauthorized data exfiltration through legitimate business channels
  • • Enable multicloud visibility and anomaly detection to identify suspicious authentication patterns, token exchange activities, and abnormal SSO access behaviors
  • • Establish threat detection capabilities with behavioral baselining to catch device code phishing flows and legitimate-but-malicious authentication abuse
  • • Integrate threat intelligence feeds into existing security tools to provide real-time IOCs and detection coverage for emerging N0va infrastructure and attack patterns

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image