Executive Summary‍

Advertised at $320 a month, NovaCookies packages real-time Microsoft 365 session theft as a subscription phishing service. Campaign artifacts reviewed across our research sources show hundreds of organizations targeted across multiple regions, while the service’s infrastructure expanded sharply from mid-May and continued appearing through August 2026. Nearly 90% of the organizations in the reviewed set were associated with lures hosted on .vu domains. A companion IOC release documents 755 domains assessed as dedicated malicious infrastructure.

Delivery methods varied across campaigns. Observed campaigns used genuine Docusign envelopes to carry counterfeit document-share lures, with some clicks routed through legitimate Microsoft or Google sign-in endpoints as redirect hops before reaching the kit. The message, document service and redirect can therefore appear trustworthy until the browser reaches attacker-controlled infrastructure.

Behind the lure, NovaCookies relays Microsoft 365 authentication through attacker-controlled infrastructure, allowing it to capture the resulting session after password and MFA submission. It combines proof of work, short-lived context binding and browser checks to resist automated analysis without making its lures unreachable. Phishing-resistant authentication remains the structural defense.

Campaigns that look unrelated can be deployments of the same rented product. Blocking yesterday’s domain removes only one disposable part of the operation.

Evidence of that commercial model was designed to disappear.. An account advertising NovaCookies sent a one-time Telegram image that it said showed one of its customers. The interface offered cookie-link purchases, orders, a wallet, redirect services and support. It looked less like a phishing kit than a subscription business.

The left-hand image was sent as a disappearing Telegram photo by the account advertising NovaCookies. The sender said it showed a buyer profile in the NovaCookies panel, labeled as a customer. We redacted all identifying details. Public posts associated with the account shown in that profile included phishing administration panels containing credential and session data. Those posts indicate phishing activity. They do not establish a NovaCookies purchase, and we found no order, payment or transaction that independently confirmed the seller’s claim.

Phishing sold as a service

The account quoted $320 for a month of access or $200 for fourteen days and said the package included domains, hosting, and Google or Microsoft branded redirect options. The prices were captured directly, and both advertised redirect variants appear in observed campaign infrastructure, consistent with the seller’s description.

The economics are straightforward. Building and maintaining an adversary-in-the-middle relay takes specialist work. Renting one lowers that barrier and gives buyers a maintained sign-in flow, infrastructure rotation and an operator interface. What appears from the outside as a series of unrelated phishing incidents can therefore be many customers using the same product.

At a glance

Infrastructure scale-up began in mid-May

The shape changed in mid-May 2026. Domain registrations accelerated, first-seen dates across our research sources reached their highest level in June, and new infrastructure continued to appear through August. Proofpoint reported NovaCookies campaign activity increasing from March through May before declining in June. Our dataset combines domain-registration dates with first-seen dates from public campaign artifacts and our own collection. It measures infrastructure visibility, not email or campaign volume. The two findings reflect different research vantage points.

Brand-themed domains and mixed-case lure paths

Many NovaCookies domains borrow recognizable company names, then mutate them with inserted letters, dropped characters or long concatenations under .vu. Four examples from the dedicated attacker-infrastructure release show the pattern:

Across the broader IOC set, some hostnames append an abbreviation, combine an acronym with a long-form company name, or stack multiple recognizable names into one label. The complete set is available in the companion GitHub release.

These names are lure infrastructure, not evidence that the referenced companies were compromised. Nor should the company embedded in a hostname automatically be treated as the recipient: across the corpus, the borrowed name and the targeted organization were not reliably the same.

NovaCookies builds its lure URLs around document-sharing language. Observed paths begin with alternating-case labels such as PwPt-sHaRe, Ms36-AcCeSs and ClOd-ViEw. These combine shortened references to familiar cloud products with actions such as share, access and view. Each label is followed by a long changing token and a shorter final token, allowing individual links to differ while retaining the same recognizable structure.

hxxps://secondsightsystilqemsllc[.]vu/

PwPt-sHaRe-[long-token]/[short-token]

The mixed casing is a useful campaign fingerprint, not proof of the scanner resistance described later in this report. Search and scan systems may normalize case, and capitalization alone does not explain why a replay fails. Analysts should treat the shape as contextual evidence alongside the domain, page behavior and anti-analysis layers, rather than as a standalone signature.

An envelope inside an envelope

The strongest delivery chain we observed began inside a service the recipient already trusted: Docusign. The email was a genuine Docusign notification. It opened a genuine Docusign envelope in the real viewer. Everything at that layer could pass normal sender-authentication and reputation checks.

The document inside the envelope was counterfeit. Styled as a Docusign share notice, it claimed that an accounting department had shared a remittance-advice PDF and invited the recipient to open it. The malicious destination sat inside the document, below the layer most mail security products inspect.

NovaCookies used a documented OAuth error-redirect technique Microsoft described in March 2026. The chain begins with an application registered in an attacker-controlled tenant, whose redirect URI points at attacker infrastructure, and a genuine Microsoft authorization URL designed to fail silent authentication. Entra then sends the browser from its own domain to that pre-registered hop. No token is issued and no consent prompt appears.

hxxps://login.microsoftonline[.]com/common/oauth2/v2.0/authorize
  ?client_id=[app-id]
  &redirect_uri=hxxps://[registered-redirect-hop]/
  &prompt=none
  &state=[opaque-state]

A smaller number of chains used Google’s sign-in endpoint for the same redirection role, supporting the seller’s advertised Microsoft and Google redirect options. Unlike a classic open redirect, the destination must already be registered to the application. The value is the trusted starting domain. The application IDs also give identity providers another disruption point when malicious registrations are reported.

A smaller number of chains used Google’s sign-in endpoint for the same redirection role, supporting the seller’s advertised Microsoft and Google redirect options. Unlike a classic open redirect, the destination must already be registered to the application. The value is the trusted starting domain. The application IDs also give identity providers another disruption point when malicious registrations are reported.

That chain is effective because each hop feels reasonable in isolation: a genuine document service, an identity-provider response, then a familiar sign-in page. Trust fails only at the final destination.

Docusign and Microsoft were not compromised in this chain. The chain used their services as delivery and redirection layers. It is a reminder that a trusted origin can still carry an untrusted journey.

Other NovaCookies delivery chains took a different route. We observed links passing through legitimate websites that appeared to have been compromised, as well as legitimate online services abused to host or redirect malicious content. These intermediate hops kept the final phishing domain out of the original message and allowed the journey to begin on an established domain before sending the browser to NovaCookies infrastructure.

Session theft beyond the credential page

NovaCookies operates as a live adversary-in-the-middle relay. The target sees a Microsoft 365 sign-in experience, while the service passes the authentication exchange to Microsoft in real time. The service relays password and MFA prompts step by step. Once Microsoft issues an authenticated session, the proxy can capture the session cookie that represents it.

The bundles show this is purpose-built rather than generic. The kit carries dedicated handling for authenticator push approval, authenticator one-time codes and SMS codes, using Microsoft's own internal names for those methods, alongside separate error states for a rejected password, a rejected code and a rejected SMS. A relay written against a generic login form would not mirror Entra's method taxonomy. It also counts submission attempts, which is consistent with the repeated-password behavior described below.

This is why ordinary one-time codes and push approvals do not solve the problem on their own: the victim is completing a real authentication, just through an attacker-controlled intermediary. Phishing-resistant authentication changes the geometry. Passkeys, FIDO2 security keys and other origin-bound credentials will not authenticate to the wrong site, so the relay cannot complete the same exchange.

Layered scanner resistance, not scanner-proof

Cloudflare is the visible front gate, but it is not the whole anti-analysis story. Its presence alone is not evidence of NovaCookies. The service layers browser checks with client-side proof of work, short-lived context binding and runtime inspection checks. Each layer frustrates a different kind of automated or delayed replay.

Recovering the client bundles changes the picture from a checklist to something closer to a fraud engine. The kit does not simply pass or fail a visitor. It scores the browser, and it weighs those signals against whether it has seen human behaviour: it will forgive a failed check when interaction looks genuine, and skip its more expensive checks entirely for a visitor that already looks human. Admission is a confidence judgement with a fallback, not a boundary.

The scoring draws on interaction patterns, device and browser characteristics, automation markers, and attempts to open developer tools or inspect the page.

These controls are exposed as buyer-configurable settings, with tunable intervals, callbacks, and strict or development presets. Each deployment can therefore use a different combination of anti-analysis controls. This makes the kit’s resistance to analysis a configurable product capability rather than a fixed sequence of checks.

One example is debugger timing, a long-documented anti-debugging technique. The client measures execution across a debugger statement. A pause when developer tools are open can contribute to its decision to withhold the lure:

started = clock()
debugger
if clock() - started > hidden_limit:
    stop_rendering()

This timing result becomes one more signal in the kit’s configurable decision about whether to render the lure.

The practical result depends on the visitor. A no-JavaScript request may stop at the outer gate. A browser can progress further. A delayed replay or changed environment may fail. Full-browser public scanners have also captured the lure on some occasions. “Scanner-resistant” is therefore the defensible description. Claims that scanners cannot reach these pages would overstate the evidence.

Targeting spanned regions and sectors

Review of our research campaign artifacts showed a geographically broad operation. Approximately nine in ten observed organizations appeared in the large .vu campaign wave. That concentration makes .vu an important feature of the current operation, but not a permanent identity: NovaCookies has used multiple domain families and hosting patterns over time.

The observed footprint was geographically broad. About half of the distinct organizations represented in the reviewed campaign artifacts were associated with the United States. The United Kingdom, Canada, Germany, Israel and the United Arab Emirates formed smaller visible concentrations. These findings indicate apparent targeting, not confirmed interaction or compromise.

The reviewed artifacts provide a conservative minimum for NovaCookies targeting across our research sources, not a complete census. An organization’s appearance in those artifacts indicates targeting, not interaction or compromise. Confirming credential submission or session theft requires separate evidence.

The Operator interface brands it as “Nova Cookies”

The kit’s operator-facing dashboard supplies its most memorable piece of branding: a circular “Nova Cookies” badge built around a cookie, alongside the line “Secured by Nova Systems.” The name is unusually candid. Passwords open the door, but session cookies are the asset that lets an AiTM operator reuse a completed Microsoft 365 authentication.

The credential flow also appeared tuned for yield. In one preserved observation, the same page accepted repeated password submissions before advancing. That behavior is consistent with collecting more than one candidate password. We did not capture a definitive error message proving that this is a fixed product rule, so we report the behavior as observed rather than assigning an exact mechanism.

The shared product does not imply a single threat actor. Different buyers can bring different targets, domains, registrars and campaign schedules while leaving the same product fingerprints. Attribution must separate the service, the account advertising it and the individual customer using it.

What defenders should do now

1. Put phishing-resistant authentication on high-value accounts. Passkeys, FIDO2 security keys and other origin-bound credentials structurally interrupt an AiTM relay.
2. Detect the product, not only yesterday’s domains. Correlate the current `.vu` lure shape, brand-themed hostname mutations, mixed-case document-action tokens and redirect chains into Microsoft-style relays. Treat any one feature as weak evidence; combine them with browser and page behavior, reputation and the versioned IOC release.
3. Keep dedicated infrastructure separate from potentially compromised hosts. Block attacker-controlled domains at the apex where appropriate; use URL- or path-level controls and investigation for legitimate sites that may have been abused.
4. Assume the delivery path may be trusted until its final hop. Inspect links inside document viewers and collaboration platforms, and do not depend on referrer data to reconstruct how a user arrived.
5. Treat a completed relay as possible session theft. Revoke sessions, reset credentials, inspect identity-provider sign-ins, and review new MFA methods, OAuth grants, forwarding rules and inbox rules.

Research limits

• Telegram material records claims made by an account advertising NovaCookies. It does not establish the seller’s identity or independently confirm any customer, order, payment or completed purchase. Identifying details have been withheld.
• Campaign artifacts across our research sources indicate targeting and infrastructure association, not successful delivery or account compromise. Geographic and sector findings describe the reviewed dataset, not a complete victim census.
• Short-lived links and differences between deployments prevented repeatable testing of every access condition. Scanner findings reflect preserved captures and controlled observations, not a claim that every deployment defeats every scanner.

Versioned indicators and disclosure

The companion IOC release publishes 755 domains. The list is sanitized: it contains no victim data, personalized lure links, Telegram identities, wallet addresses or internal telemetry.

GitHub IOC repository: Island Security Research Artifacts repository

Indicators are evidence with an expiration date. NovaCookies rotates infrastructure, and legitimate domains can be abused. Consumers should retain the package version, review the handling notes and combine IOCs with behavior-based detections.

NovaCookies’ infrastructure is designed to vanish. Its service model is built to persist. Defenders will catch up faster when they investigate the product behind the domains, not only the domain that happened to be live yesterday.

The browser is where the chain becomes one session

NovaCookies is built so each hop can look legitimate on its own: a trusted delivery service, an identity-provider redirect, then a familiar sign-in page. Those pieces often land in different tools. The browser is where they become a single event.

That is the layer Island Enterprise Browser is built to control. It can apply policy as the page renders and restrict sensitive actions on unfamiliar or unmanaged destinations. These controls operate inside the browser session rather than after an analyst reconstructs the path across separate tools. Phishing-resistant authentication remains the structural defense. Browser-level control adds enforcement after the click.

‍