# Your MFA Is Not Enough: The $320-a-Month Kit Stealing Microsoft 365 Sessions Right Now
For years, the security industry sold multi-factor authentication as the answer to credential theft. Enable MFA, the pitch went, and a stolen password becomes worthless. That narrative has been eroding for a while. NovaCookies is another shovel in the grave.
NovaCookies is a phishing-as-a-service (PhaaS) platform operating on a $320-a-month subscription. What it offers isn't a credential harvester — those are almost quaint by comparison. It's an adversary-in-the-middle (AitM) proxy that sits between a victim and Microsoft 365, forwards traffic in real time, and walks away with the authenticated session cookie. By the time the victim finishes logging in, an attacker already has a token that says they're already logged in too.
## How the Proxy Does the Heavy Lifting
The mechanics of AitM phishing aren't new — researchers have documented frameworks like Evilginx and EvilProxy for years — but NovaCookies represents the continued industrialization of the technique. Instead of requiring an attacker to stand up and maintain reverse-proxy infrastructure, configure interception rules, or understand the authentication flow they're targeting, NovaCookies abstracts all of that into a monthly service.
Here's the sequence: a target receives a phishing link and clicks through to what appears to be a legitimate Microsoft 365 login page. It *is* a legitimate login page, rendered through NovaCookies' proxy. Every HTTP request the victim sends to "Microsoft" actually travels through the kit's server first. The victim enters credentials, completes MFA — SMS, authenticator app, hardware token, it doesn't matter — and Microsoft issues a session cookie. The proxy captures it before passing the response back to the victim.
The victim lands in their inbox. The attacker has a valid session token.
That token is what matters. Modern web authentication doesn't re-verify identity on every request; it trusts the cookie. Feed that cookie into a browser, and the attacker is authenticated as the victim. No credentials needed, no MFA prompt triggered, no anomaly for the user to notice.
## Thirty Dollars a Week for Enterprise Access
The $320 price point deserves attention on its own. That's roughly what a mid-tier SaaS subscription costs — less than most project management tools, far less than an enterprise security license. The economics of cybercrime-as-a-service have been deteriorating for defenders for a decade, but AitM-as-a-service at this price normalizes a capability that used to require meaningful technical skill.
For context: EvilProxy, one of the more mature AitM PhaaS platforms, reportedly offered pricing in a similar range when it surfaced in 2022. Caffeine launched around the same time, offering Microsoft 365 and Google Workspace phishing infrastructure for as little as $200 a month. The market is competitive. Prices are stable. Operators are clearly making money.
What NovaCookies adds to this ecosystem isn't technical novelty — it's another point of access, another vendor competing for business from actors who couldn't or wouldn't build AitM tooling themselves. The supply side of session-stealing infrastructure is, apparently, healthy.
## Microsoft 365 Is the Target for a Reason
The platform specificity matters. Microsoft 365 isn't targeted because attackers hate Microsoft. It's targeted because M365 is the identity and productivity layer for an enormous fraction of enterprises globally. Exchange Online holds corporate email. SharePoint holds internal documents. Teams holds sensitive conversations. OneDrive holds files. Azure AD — now Entra ID — often integrates with every other system in the environment.
A single hijacked M365 session can cascade. An attacker with authenticated access to a CFO's mailbox can search for wire transfer approvals, set forwarding rules, review calendar entries for upcoming deals, and pivot to any connected application that trusts the Entra identity. Session cookies aren't just login tokens; in a federated environment, they're keys to the kingdom.
Business email compromise losses exceeded $2.9 billion in the most recent FBI IC3 report. AitM is increasingly the technical mechanism behind BEC — not because attackers got smarter, but because the tooling got cheaper and more accessible.
## What Defenders Actually Need to Change
Telling security teams to "implement MFA" misses the point entirely at this stage. The question is which controls actually matter when MFA can be transparently bypassed.
Conditional Access based on device compliance and network signals is the most direct response. Microsoft's own guidance recommends requiring compliant devices or hybrid Azure AD joined devices for M365 access. A session cookie stolen via AitM and replayed from an attacker-controlled machine in a different country should fail if Conditional Access policies evaluate device state and IP risk signals at authentication time.
Token binding and hardware-backed credentials through FIDO2 are the more robust answer. FIDO2 passkeys cryptographically bind authentication to the specific domain and device. An AitM proxy cannot relay that assertion — the credential proof doesn't travel over HTTP at all. Microsoft, Google, and Apple have all pushed hard on passkey adoption. The reason it matters is exactly this.
Real-time session anomaly detection is the backstop when prevention fails. Unexpected sign-in geography changes mid-session, impossible travel scenarios, or token replay from a new device are detectable signals. Microsoft Defender for Cloud Apps and similar tools can terminate sessions automatically when anomalous access patterns appear.
Phishing-resistant MFA isn't optional anymore. It's the baseline.
---
## HackWire Analysis
NovaCookies fits a pattern that's been developing since at least 2020: the commoditization of attack techniques that previously required operational sophistication. The trajectory is worth tracking explicitly.
First came credential phishing kits. Then came MFA bypass through OTP relay (the simple version, where a human operator relays one-time codes manually in real time). Then came AitM proxies, which automated the relay entirely. Now those proxies are subscription services with customer support, pricing tiers, and marketing copy.
What's being missed in most coverage of this story is the *insurance problem* it creates. Organizations that have diligently implemented MFA have often satisfied internal security requirements, checked compliance boxes, and lowered cyber insurance premiums. Their documented controls say "MFA enabled." Their actual protection against session hijacking via AitM is a different, harder question — and the answer depends on implementation details most audits don't reach.
The compliance gap is material. SOC 2, ISO 27001, and most cyber insurance questionnaires ask whether MFA is enabled. They don't distinguish between SMS OTP (bypassable by AitM), TOTP apps (also bypassable), and FIDO2 hardware keys (not bypassable). An organization that believes its MFA policy constitutes real session protection may have passed every audit and still be wide open to NovaCookies or any of its competitors.
The broader Microsoft 365 supply chain risk is also underappreciated. A single compromised M365 tenant in a law firm, accounting firm, or healthcare network gives an attacker access to client communications and sensitive documents across dozens of that firm's downstream clients — none of whom are in the attacker's original target set. AitM attacks don't just compromise individuals; they compromise trust networks.
For defenders: audit whether your M365 Conditional Access policies actually block session replay from non-compliant devices. If the answer requires more than two minutes to verify, that's the problem.
— HackWire Editorial
---
## Related Coverage