NovaCookies PhaaS Relays M365 Sessions Through Docusign Envelopes and OAuth Error Redirects

NovaCookies operates as a centrally hosted phishing-as-a-service platform that intercepts Microsoft 365 authentication flows in real time. Victims receive authentic Docusign envelope notifications containing malicious document links. Clicks pass through Microsoft or Google sign-in endpoints before landing on attacker infrastructure that relays credentials and MFA tokens. The kit includes Cloudflare gating and debugger detection to block scanners. Evidence from domain registrations on .vu TLDs and alternating-case URL labels such as Ms36-AcCeSs shows deliberate attempts to mimic trusted services while evading reputation filters. Island's telemetry recorded campaigns against hundreds of organizations in the US, UK, Canada, Germany, Israel and UAE. Proofpoint identified NovaCookies as a managed evolution of the earlier Sneaky2FA kit, now offering dedicated flows for Okta and Entra federations. The Telegram channel handles customer provisioning, redirect configuration and support, confirming the shift from affiliate-hosted kits to operator-controlled infrastructure. The campaign exploits the March Microsoft OAuth error-redirect technique to chain legitimate identity-provider hops into the malicious relay. This multi-hop design fragments detection across email, identity and endpoint tools. The use of genuine Docusign messages bypasses sender-authentication checks that most mail gateways rely on, a pattern previously observed in other document-service abuses but rarely combined with live session proxying at this scale. Operators will likely expand federated identity coverage and rotate .vu domains faster. Expect increased targeting of GoDaddy and Okta tenants as the managed model lowers barriers for less skilled affiliates. Defenders should monitor for OAuth redirect chains terminating in Cloudflare-protected domains with alternating-case paths.