NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions

Cybersecurity researchers disclosed a new adversary-in-the-middle phishing toolkit called NovaCookies that acts as a proxy to redirect Microsoft 365 sign-ins while capturing authenticated sessions. Island characterized the $320/month service as a subscription-based phishing platform. The campaign abuses genuine Docusign notifications to steal Microsoft 365 sessions.