What Happened
Security researchers disclosed NovaCookies, a subscription phishing platform sold for roughly $320 a month and built to steal active Microsoft 365 sessions rather than passwords. The kit operates as an adversary-in-the-middle proxy, sitting between a victim and the genuine Microsoft sign-in page so it captures the authenticated session cookie the moment a user completes login, including multi-factor prompts. Observed campaigns rely on genuine Docusign envelope notifications carrying counterfeit document-share links, with some clicks routed through legitimate Microsoft or Google sign-in endpoints as redirect hops before landing on the phishing infrastructure. Built-in evasion features, including short-lived context binding and runtime inspection, help the lures slip past automated email scanners. Hundreds of organizations across the United States, United Kingdom, Canada, Germany, Israel, and the United Arab Emirates have been targeted.
Why This Matters for Canadian Organizations
Canada sits among the confirmed target countries, and the underlying weakness NovaCookies exploits, MFA relying on session cookies without additional device or context verification, applies to any Canadian organization running Microsoft 365. Once an attacker holds a stolen session token, standard password resets and even MFA re-enrollment often fail to close the access, since the token remains valid until it expires or gets explicitly revoked. Under the Office of the Superintendent of Financial Institutions’ B-13 guideline, regulated entities carry responsibility for identity and access controls resilient against session-based attacks, not password theft alone. A compromised session exposing customer records also triggers breach notification duties under PIPEDA, regardless of whether the intrusion involved a traditional credential theft.
What to Do
Security teams should move toward phishing-resistant authentication methods, including FIDO2 security keys and certificate-based device binding, which are not vulnerable to session cookie theft in the same way as standard MFA prompts. Conditional access policies enforcing device compliance and geographic or network location checks add a second barrier even after a token is stolen. Security awareness training deserves an update reflecting a new reality: legitimate-looking Docusign or vendor notifications, not only obvious spoofed pages, now carry phishing links. Session tokens showing signs of anomalous reuse should trigger automatic revocation rather than waiting for a user report. Full details are available from The Hacker News.
