NovaCookies Kit Steals M365 Sessions for Just $320 a Month

A new phishing-as-a-service offering dubbed "NovaCookies" is enabling low-skilled cybercriminals to conduct adversary-in-the-middle (AitM) attacks against Microsoft 365 users for as little as $320 per month. The kit dramatically reduces the technical expertise required to hijack active cloud sessions, effectively commodifying a class of attack previously limited to more sophisticated threat actors.

Unlike conventional credential-phishing kits that harvest static usernames and passwords, NovaCookies proxies the entire Microsoft 365 authentication flow through attacker-controlled infrastructure. When a victim submits their credentials on a spoofed login page, the kit captures the session cookies issued after successful authentication, allowing the operator to import them into a browser and impersonate the user without ever knowing the underlying password. In many Microsoft 365 configurations, this approach also defeats SMS-based and push-based multi-factor authentication, since the session token is stolen after MFA has already cleared.

Researchers warn that the rise of subscription-based AitM kits reflects a broader commercialization of the phishing economy, where enterprise-grade tradecraft is now accessible to any buyer with a few hundred dollars and a Monero wallet. Defenders are advised to enforce phishing-resistant authentication using FIDO2 hardware tokens or Windows Hello for Business, monitor Microsoft 365 sign-in logs for impossible-travel or anonymous-IP activity, and audit persistent session tokens via the Microsoft Entra admin center. End users can reduce their blast radius by checking whether their credentials appear in known dumps using a breach lookup, confirming password hygiene with a password strength checker, and validating the certificate chain of any suspicious login portal using an SSL/TLS checker before entering corporate credentials.