# Your Docusign Is Real. The Payload Inside Isn't.
A phishing kit called NovaCookies has turned one of enterprise security's most trusted document services into an attack surface — and it does it without sending a single spoofed email.
Researchers at Island, a browser security company, disclosed the toolkit this week after tracking campaigns that hit hundreds of organizations across the United States, United Kingdom, Canada, Germany, Israel, and the UAE. The targets span multiple sectors. The price of entry: $320 a month, subscription-based, fully managed, support included.
What separates NovaCookies from the endless parade of phishing kits isn't the sophistication of any single technique — it's the architecture of legitimacy. Each hop in the attack chain looks clean to the tool inspecting it. The email is a genuine Docusign notification. The redirect passes through legitimate Microsoft or Google infrastructure. The login page looks exactly like Microsoft 365. Nothing flags until the browser has already handed over your authenticated session.
## How the Chain Is Assembled
The attack starts with a real Docusign envelope — not a spoofed one. The attacker uses the service legitimately, embedding the malicious URL inside the document itself, below the layer most mail security products inspect. The notification email that hits the victim's inbox passes sender authentication and reputation checks because it *is* authentic Docusign infrastructure. Filtering rules built to catch impersonated domains don't help here.
Clicking through to the document leads to the payload URL, which then routes victims through what Island describes as an "OAuth error-redirect technique" — a method Microsoft itself documented in March of this year — to land them on attacker-controlled infrastructure. The infrastructure runs as a live adversary-in-the-middle relay: it proxies the real Microsoft 365 authentication flow, capturing credentials and MFA codes in transit, and harvests the resulting session cookies once authentication completes.
The victim logs in successfully. MFA fires. Microsoft confirms the login. And the attacker now holds a valid session that lets them access email, SharePoint, Teams, and whatever else 365 grants — no password needed going forward.
NovaCookies is assessed by Proofpoint to be a variant of the Sneaky 2FA kit, which surfaced last year targeting primarily Microsoft accounts. The NovaCookies version expands the scope to include dedicated flows for Okta and Entra domains federated to GoDaddy — a meaningful upgrade for attackers going after mid-market companies that rely on those identity providers.
## The PhaaS Model Makes This Scalable
The economics matter. This isn't a custom job requiring a skilled attacker to build and operate their own infrastructure. NovaCookies is advertised on Telegram, managed through Telegram, and hosted centrally by the operators. Affiliates pay the subscription and run campaigns; the operators handle the backend. That model means anyone willing to spend $320 a month can target a Fortune 500 company with enterprise-grade session theft.
The kit includes anti-analysis measures that reflect real operational maturity: a Cloudflare gate, detection of debugging tools, and mechanisms to evade security scanners before serving the fake login page. Lure domains lean heavily on the .vu TLD — a ccTLD for Vanuatu that has apparently found a second career in phishing infrastructure — with URLs using alternating-case patterns like PwPt-sHaRe and Ms36-AcCeSs to mimic Microsoft branding without exact string matches.
## MFA Didn't Fail — The Attack Circumvented It
This is worth stating plainly, because the marketing around multi-factor authentication has created a dangerous confidence in organizations that have rolled it out: MFA doesn't protect against session theft. It protects against credential replay. NovaCookies, like Evilginx, Modlishka, and every other AitM kit, doesn't need to break MFA. It proxies through it. The victim completes MFA; the attacker captures what MFA produces.
The only authentication mechanism that actually defeats this class of attack is phishing-resistant MFA — FIDO2 hardware keys or passkeys. These bind the authentication ceremony to the origin domain. A relay attack can't complete the handshake because the attacker's proxied domain isn't the legitimate one. No successful completion, no valid credential to steal.
Conditional Access policies tied to device compliance and Microsoft's Continuous Access Evaluation (CAE) can limit the blast radius of stolen sessions by enforcing re-authentication or revoking tokens when anomalous signals appear. Browser isolation products — the category Island sells, worth noting — prevent the browser from directly contacting attacker infrastructure by routing traffic through an isolated cloud browser.
For defenders not ready to roll out hardware keys across the org, the .vu domain pattern and the alternating-case URL signature in NovaCookies campaigns offer detection opportunities now. Those patterns should be in your proxy and DNS filtering rules.
---
## HackWire Analysis
The NovaCookies disclosure lands during a period of accelerating PhaaS commoditization. Evilginx has been public since 2017. Modlishka followed. CredSniper, Muraena, Greatness, Tycoon 2FA — the toolkit lineage is long and the progression is clear: each generation becomes cheaper to operate, harder to detect, and more accessible to lower-skilled attackers.
What's underreported in the coverage of this specific campaign is the *fragmentation problem* Island identified. Each leg of the attack chain sits in a different security tool's visibility zone. Email security sees a legitimate Docusign notification. URL inspection tools see Microsoft and Google redirect infrastructure. The browser-delivered login page looks pixel-perfect. No single tool sees the whole chain — only the browser does, and most organizations aren't treating the browser as a security perimeter.
This is why the $320/month price point matters more than the technique itself. AitM attacks were once the domain of nation-state actors with custom infrastructure. Midnight Blizzard used session theft techniques against Microsoft's own executives in early 2024. Today, the same capability is available to a threat actor with a Telegram account and a credit card.
The sectors targeted — unspecified in the disclosure but described as "multiple" across six countries — almost certainly include financial services, healthcare, and professional services firms that use Microsoft 365 heavily and have federated identity through the providers NovaCookies explicitly targets. If your organization runs Okta or GoDaddy-federated Entra, you're in scope.
The ask for defenders is uncomfortable but clear: MFA rollout completion is not the finish line. FIDO2 migration needs to become a roadmap priority, not a future aspiration. Every month that passes at $320 is another month this toolkit runs campaigns at scale.
— HackWire Editorial
---
## Related Coverage