> TritonInfoSec News
Home / Aug 27, 2026 / Story
0
#9 The Hacker News general August 26, 2026 at 13:44 UTC

NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions

By [email protected] (The Hacker News)

AI Summary

Researchers at Island disclosed NovaCookies, an adversary-in-the-middle (AitM) phishing toolkit sold for $320/month that abuses genuine DocuSign notifications to proxy Microsoft 365 sign-ins and capture authenticated sessions, bypassing MFA entirely. The platform lowers the barrier for credential theft attacks by providing subscription-based infrastructure that handles session cookie harvesting automatically. Security teams should implement phishing-resistant authentication (FIDO2/passkeys) and monitor for AitM-style proxy indicators in M365 telemetry.

Read full article → https://thehackernews.com/2026/08/novacookies-camp…

Relevance score: 80.0/100

# More from August 27

  1. 1
    Officials disrupt Chinese espionage operation that hit multiple federal agencies CyberScoop
  2. 2
    US takes down alleged Chinese hacking tools used against Federal Reserve, DOJ and Senate The Record
  3. 3
    CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing The Hacker News
  4. 4
    Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload The Hacker News
  5. 5
    Hackers target Microsoft SharePoint RCE chain with PoC exploit BleepingComputer
  6. 6
    Three 10.0 security flaws fixed across Ubiquiti’s UniFi line CyberScoop
  7. 7
    OpenAI: Agent behavior that led to Hugging Face intrusion formed in May CyberScoop
  8. 8
    U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches The Hacker News
  9. 10
    New GPUThor attack defeats NVIDIA ECC protection for root access BleepingComputer