A phishing kit dubbed N0va is targeting organizations in North America and Europe by impersonating familiar business services (like Microsoft Teams/SharePoint and DocuSign) and pushing victims through legitimate sign-in flows. By capturing authentication tokens rather than dropping obvious malware, attackers can gain access to corporate email, files, and cloud applications tied to the victim’s account.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get this email: “A file was shared with you in Microsoft Teams, sign in to view.” Looks totally normal, right? Behind that button might be N0va, a phishing kit that abuses real Microsoft and Google sign-in screens. You click, you see the usual company SSO, you log in, and N0va quietly grabs your access tokens. Here’s the trap: the login is real, the brand is real, Teams, SharePoint, DocuSign, Google Drive, Dropbox, Zoom, but the path there is wrong. It started from an email or website you weren’t expecting, and the redirects feel off. If a “document shared” or “sign-in required” email feels even slightly off, don’t log in from that link, open the app yourself and check there, then report the email to security.
Researchers reported a real phishing operation (“N0va” phishkit) that tricks people into signing into Microsoft through a legitimate Microsoft page, but for an attacker-started session. Victims can complete MFA and still grant the attacker access and refresh tokens, letting the attacker operate as…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
Researchers showed how an attacker could trick Microsoft Copilot into running a malicious prompt automatically just by getting a user to click a specially crafted link. The prompt can then make Copilot search connected accounts (like email and cloud storage) and send information to an external…
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
