Most of the DMARC-authenticated phishing this blog has covered relies on hijacking somebody else’s trusted domain, a compromised Amazon SES account, a genuinely Microsoft-sent Azure Monitor alert, a real vendor notification pipeline. NovaCookies does something quieter and, in a way, more unsettling. Island senior security researcher Shachar Gritzman has spent months tracking a subscription phishing-as-a-service kit that steals live Microsoft 365 session cookies for $320 a month, and the mail it sends does not need to hijack anyone. It clears SPF, DKIM, and DMARC because the attacker registered the sending domains, configured the records, and did the alignment work themselves. The kit has hit hundreds of organizations across the United States, the United Kingdom, Canada, Germany, Israel, and the United Arab Emirates, with infrastructure that expanded sharply from mid-May 2026 and was still active in August.
A Correctly Configured Domain Is Not the Same as a Trustworthy One
NovaCookies operators run ten sender domains, four ending in .com and six in .asia, funneled through nine separate SendGrid accounts. Every one of those domains has valid SPF and DKIM records, and DMARC alignment checks out cleanly because sender and signer match by design. This is the part worth sitting with. DMARC was built to answer one question: is the entity sending this mail actually authorized to use this domain. A brand-new domain registered last week, with no history, no reputation, and no legitimate purpose, can answer that question with a perfect yes, because the only authority DMARC checks is the authority the domain owner grants to themselves. Nothing in the protocol asks whether the domain has earned any trust. Nothing asks how old it is, what it is for, or who is actually behind it. NovaCookies’ mail sails through the exact mechanism that is supposed to stop spoofing, without spoofing anything.
The Docusign Envelope Is Real, and the OAuth Redirect Is Real Too
The domains handle delivery, but the lure and the escape route both borrow legitimate infrastructure that never needed to be compromised. Observed campaigns wrap the phishing link inside a genuine Docusign envelope carrying a counterfeit document-share notice, so the recipient sees an authentic Docusign email pointing to what looks like a shared file. Clicking the link routes through a legitimate Microsoft or Google sign-in endpoint before the victim ever reaches attacker infrastructure, using an OAuth error-redirect technique Microsoft itself documented back in March 2026. The attacker deliberately triggers a silent authentication failure, an invalid scope parameter or a prompt=none request that cannot resolve quietly, and Microsoft Entra ID responds by redirecting the browser to whatever redirect URI the attacker registered, along with the error details. Each hop in that chain looks legitimate because each hop actually is legitimate, right up until the last one. The final destination is a reverse proxy that relays the victim’s real Microsoft 365 login in real time and walks away with the authenticated session cookie itself.
Stealing the Session Skips the Question MFA Was Built to Answer
Multi-factor authentication protects a password. It does nothing for a session that has already been granted and then lifted wholesale. Because NovaCookies operates as a live adversary-in-the-middle proxy sitting between the victim and Microsoft’s real login page, the victim’s MFA challenge gets satisfied normally, against the real Microsoft infrastructure, while the kit captures the resulting session cookie on its way back through. From that point the attacker holds a working, authenticated session and does not need the victim’s password, their MFA device, or another login attempt. Every layer of identity verification did its job correctly. The theft happened after verification succeeded, not instead of it.
What This Means for Your Program
A DMARC pass on an inbound message tells you the sending domain is internally consistent, not that it is safe. Domain age, registration patterns, and sending reputation belong in your filtering stack as separate signals, because DMARC alignment alone cannot distinguish a legitimate new vendor from a phishing operation that registered ten domains last quarter for exactly this purpose.
Treat multi-hop links with real intermediate stops as a bigger red flag, not a smaller one. A link that passes through an actual Microsoft or Google endpoint before landing somewhere else is designed specifically to defeat the instinct to check where a link leads, since the visible first hop is genuinely trustworthy.
Session-cookie theft means your MFA policy is necessary but not sufficient. Pair it with conditional access controls that evaluate session risk continuously, token binding where your identity provider supports it, and short session lifetimes that shrink the window a stolen cookie stays useful.
If your organization uses Docusign or a similar e-signature platform, warn people that a legitimate-looking envelope is not proof the underlying request is legitimate. Attackers do not need to compromise Docusign to abuse the trust people place in its notifications.
The Takeaway
NovaCookies is a reminder that authentication protocols and trust are not the same thing, even when the protocols work exactly as designed. Ten domains with clean DMARC alignment, a genuine Docusign notification, and a real Microsoft OAuth endpoint combine into a chain where every individual link checks out, and the sum is still a $320-a-month session-theft service running against hundreds of organizations. DMARC did what it was built to do here. It just was never built to answer the question this attack actually depends on: whether the domain asking for trust deserves it.
DMARC tells you whether a domain is authorized to send, not whether it deserves anyone’s trust. Excello Mail turns your own domain’s DMARC aggregate reports into a clear, continuous record of every service sending as you, so a newly registered look-alike domain trying to piggyback on your name does not go unnoticed. Sign up for free to Excello Mail and keep that visibility working while your team handles the rest.