GoKawiilPhishing-as-a-service kit 'NovaCookies' hijacks Microsoft 365 logins for $320/month
Researchers have identified a subscription-based phishing toolkit called NovaCookies that uses adversary-in-the-middle techniques to intercept live Microsoft 365 login sessions. Rather than just harvesting usernames and passwords, the kit captures session cookies, letting attackers bypass multi-factor authentication and take over accounts directly. It is being sold as a service for roughly $320 a month, making advanced phishing capability accessible to less-skilled criminals.
GoKawiil's interpretation of the reporting above, not reported fact.
By packaging session-hijacking phishing into an affordable rental service, NovaCookies significantly lowers the technical bar for account takeover attacks against enterprise cloud accounts. Because it steals active session tokens rather than static credentials, it can defeat MFA protections many organizations rely on as a primary defense, raising the risk of business email compromise and downstream fraud.
- NovaCookies is a phishing-as-a-service kit targeting Microsoft 365 accounts.
- It steals session cookies via adversary-in-the-middle attacks, bypassing multi-factor authentication.
- Priced around $320/month, it broadens access to sophisticated phishing tools for low-skill attackers.
YubiKey 5C NFC Security Key — Session-stealing phishing kits thrive on codes and cookies that can be relayed, which is exactly what phishing-resistant hardware keys are designed to stop. The YubiKey 5C NFC supports FIDO2/WebAuthn for Microsoft 365 sign-ins and works over USB-C or tap-to-authenticate NFC on your phone. It's a pocket-sized upgrade over app-based one-time codes.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com, 2026-08-26
Published there as: “'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.