The adversary-in-the-middle (AitM) phishing service lowers the barrier to entry for actors to create attacks and steal more than just user credentials.
August 26, 2026 By Elizabeth Montalbano
Source: DPA Picture Alliance via Alamy Stock Photo
A novel phishing service is giving attackers a turnkey solution to steal authenticated Microsoft 365 sessions for only $320 a month, bypassing multifactor authentication (MFA) protections and highlighting the need for more robust security for enterprise email.
Researchers from enterprise browser maker Island discovered the adversary-in-the-middle (AitM) phishing service, dubbed "NovaCookies," which provides lures, domains, hosting, redirects, and support to relay Microsoft 365 logins in real time to steal authenticated sessions, according to a report published today by Shachar Gritzman, a senior security researcher at Island.
NovaCookies — which also includes an option to pay $200 for 14 days — runs like a commercial operation and is targeting hundreds of organizations across multiple regions, with at least 755 domains as part of its dedicated infrastructure. More than half of those organizations are in the US or related to entities in the country, and the infrastructure for the campaign "expanded sharply" from mid-May as it continued to appear through August, Gritzman wrote.