Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365 lookalike sign-in flow, capturing credentials and MFA codes to hijack sessions.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a real DocuSign email: accounting shared a remittance-advice PDF. Looks legit, right? That’s exactly what NovaCookies counts on. Behind that button is NovaCookies, a $320-a-month phishing kit. Your click bounces through real Microsoft or Google sign-in pages, then lands on an attacker-controlled Microsoft 365 login that silently relays your password and MFA in real time. Here’s the trap: every hop looks fine on its own. Real DocuSign sender. Familiar Microsoft redirect. Clean Microsoft 365 sign-in. The only tells are: you weren’t expecting that remittance, the URL isn’t your normal M365 login, and the path looks weird, like 'PwPt-sHaRe' or 'Ms36-AcCeSs'. If you get a DocuSign remittance you weren’t expecting, stop. Don’t sign in from that link. Instead, close it and open Microsoft 365 from your usual bookmark or our portal, then check there.
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
Okta says it gained an inside look at “Work Panel,” a polished SaaS-style dashboard that helps voice-phishing (vishing) crews rapidly set up fake login sites and guide victims through password and MFA capture. The tool clones brand look-and-feel for services like Okta and Microsoft 365, then lets a…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
