aviatrix logoAviatrix
Under Active Attack

Executive Summary

In August 2026, cybersecurity researchers disclosed the NovaCookies phishing toolkit, a $320/month subscription-based adversary-in-the-middle (AitM) service targeting Microsoft 365 credentials. The campaign exploited genuine DocuSign notifications to deliver counterfeit document-share lures, bypassing email security controls by routing victims through legitimate Microsoft or Google sign-in endpoints before redirecting to attacker-controlled infrastructure. NovaCookies successfully harvested authenticated sessions from hundreds of organizations across the U.S., U.K., Canada, Germany, Israel, and U.A.E., capturing both passwords and multi-factor authentication codes in real-time through its proxy-based architecture.

This incident highlights the growing sophistication of phishing-as-a-service platforms that abuse trusted services and legitimate authentication flows to evade detection. The rise of commercial AitM toolkits represents a significant escalation in credential theft capabilities, enabling low-skilled attackers to bypass traditional security controls.

Why This Matters Now

The proliferation of sophisticated phishing-as-a-service platforms like NovaCookies demonstrates how cybercriminals are industrializing credential theft through legitimate service abuse, making traditional email security and MFA protections insufficient against modern adversary-in-the-middle attacks.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

NovaCookies exploited genuine DocuSign notifications as delivery vehicles, making the initial email appear legitimate while embedding malicious destinations within shared documents below the inspection layer of most mail security products.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely reduce the blast radius of this NovaCookies phishing campaign by limiting lateral movement across cloud environments and constraining access to federated identity systems through workload segmentation and east-west traffic controls.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Zero trust architecture could likely limit the scope of initial credential capture by segmenting access to cloud workloads and reducing the number of systems reachable through compromised user sessions

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Microsegmentation policies would likely constrain the privileges available to hijacked sessions by limiting access to specific workloads and reducing the scope of administrative functions reachable through compromised accounts

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely reduce lateral movement between federated identity systems by enforcing segmentation policies that limit cross-domain access and constrain reachability across cloud service boundaries

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility controls could likely reduce the persistence of command channels by monitoring cross-cloud communication patterns and limiting unauthorized session activity across federated identity boundaries

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely limit data exfiltration by restricting outbound communication paths and reducing the volume of organizational data accessible through compromised cloud sessions

Impact (Mitigations)

Remaining impact would likely be limited to data and systems within the compromised user's authorized access scope, with reduced blast radius across organizational cloud environments and constrained downstream account takeover opportunities

Impact at a Glance

Affected Business Functions

  • Identity and Access Management
  • Email Communications
  • Document Management Systems
  • Microsoft 365 Productivity Suite
Operational Disruption

Estimated downtime: 2 days

Financial Impact

Estimated loss: $150,000

Data Exposure

Microsoft 365 authentication sessions, user credentials, multi-factor authentication codes, and potentially access to corporate email, documents, and cloud-based business applications across hundreds of targeted organizations in multiple sectors including finance, healthcare, manufacturing, and government services.

Recommended Actions

  • • Implement Zero Trust Segmentation with identity-based policies to prevent lateral movement between federated domains and limit blast radius of compromised credentials
  • • Deploy Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration attempts and connections to known phishing infrastructure
  • • Enable Multicloud Visibility & Control to monitor anomalous authentication patterns and detect AitM phishing attempts across identity providers
  • • Utilize Threat Detection & Anomaly Response capabilities to establish behavioral baselines and alert on suspicious session patterns and credential usage
  • • Implement Cloud Native Security Fabric controls to provide real-time inspection and autonomous response to phishing attempts and session hijacking attacks

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image