NovaCookies Turns Real Docusign Emails Into Session Theft

The email is genuine. That is the entire trick. The notification comes from Docusign's own sending infrastructure, signed by Docusign, aligned to Docusign's domain. Every check a mail gateway runs comes back clean, because every one of them is true. The fraud starts one layer down, inside the envelope, in a document that walks you toward something that looks like a Microsoft sign in page and is not.

Key Takeaways

• Island disclosed NovaCookies on 26 August 2026 as a subscription phishing service selling Microsoft 365 session theft for $320 a month or $200 for fourteen days.
• The lure is delivered through genuine Docusign envelopes, so the notification passes SPF, DKIM and DMARC because Docusign really did send it.
• Island documented 755 dedicated malicious domains, with roughly half the affected organisations in the United States and further clusters in the United Kingdom, Canada, Germany, Israel and the UAE.
• NovaCookies captures the authenticated session cookie rather than the password, so the multifactor prompt is already satisfied before the attacker replays the token.
• Proofpoint assesses NovaCookies as a variant of the Sneaky 2FA kit, now shipping flows for Okta, Entra domains and GoDaddy federated services.

What Is NovaCookies?

NovaCookies is an adversary in the middle phishing platform sold by subscription: it sits between a victim and Microsoft's real login endpoint, passes every input through, and keeps the session cookie issued at the end. Island's writeup puts access at $320 a month or $200 a fortnight, bundling domains, hosting and Microsoft or Google branded redirects. The buyer brings a target list. The service brings everything else.

Do the arithmetic nobody else did on this story. At the volumes The Hacker News reported on 26 August — hundreds of organisations — the marginal cost of attempting one more company lands under a dollar. That asymmetry, not any clever redirect, is why the category keeps growing.

How Does a Genuine Docusign Email Become a Phishing Lure?

The attacker sends a real signature request from a real Docusign account and hides the malicious link inside the document rather than the email. Island's phrase: a trusted origin can still carry an untrusted journey.

1. The attacker creates an envelope in a Docusign tenant they control and adds the target as a recipient. Docusign's servers send the notification.
2. The envelope opens in the authentic Docusign viewer, at a Docusign URL, with a valid certificate.
3. Inside sits a counterfeit share notice. One sample claimed an accounting department had shared a remittance advice PDF.
4. The link starts a hop chain, and the first hop is often Microsoft's own. Island observed the OAuth error redirect technique Microsoft described in March 2026: an app registered in an attacker controlled tenant, a pre registered redirect URI aimed at attacker infrastructure, and a genuine login.microsoftonline.com/common/oauth2/v2.0/authorize request built to fail silent authentication. No token, no consent prompt. Entra just redirects the browser from its own domain to the attacker's hop.
5. Before any login form renders, the kit runs anti analysis checks: a Cloudflare gate, browser fingerprinting, client side proof of work, debugger timing detection.
6. The counterfeit form relays the password and the multifactor response to Microsoft in real time. Microsoft issues a session. The kit keeps it.

Why Don't SPF, DKIM and DMARC Catch This?

Because the message genuinely is from Docusign, which is all those three protocols were designed to establish. SPF confirms the sending IP is authorised for the envelope domain. DKIM confirms a signature over selected headers and the body validates against a published key. DMARC, defined in IETF RFC 7489, checks that one of those results aligns with the visible From domain.

None of them says anything about what the message asks you to do. Authentication proves provenance, never intent, and a criminal with a paid Docusign account has entirely legitimate provenance. The payload is not in the email, so scanning the email finds nothing.

Why Steal the Session Cookie Instead of the Password?

Because a session cookie is a credential that has already cleared multifactor authentication. The attacker imports it into their own browser and is signed in as the victim: no prompt, no push, no one time code, because from Microsoft's side that challenge was answered minutes ago. Same structural failure as the Outlook session hijacking campaign we covered in July and the Payroll Pirates operation that kept hijacked M365 sessions alive on an eight hour refresh cycle.

Three consequences follow. A password reset fixes nothing until existing sessions are revoked. Conditional access that evaluates only at sign in will pass a replayed token from another continent, because that token was minted during a session which satisfied every condition. And the account is not just a mailbox: it is an identity with Microsoft Graph reach across mail, files and app consent, which is how one relayed login becomes inbox rules, invoice interception and lateral phishing from a trusted internal address.

Microsoft's answer is to stop treating a token as portable. Continuous access evaluation lets Exchange Online, SharePoint and Teams react to revocation events in near real time rather than waiting an hour for expiry, and token protection binds a refresh token to its issuing device, so a proxied copy is useless elsewhere. Contrast the password spraying wave that skipped the MFA prompt entirely through legacy authentication: that attack avoided the challenge, this one launders it.

How Big Is the Campaign?

Island counted 755 dedicated malicious domains and traced the service to low volume infrastructure in late 2025. Registrations accelerated in mid May 2026, peaked in June, and kept appearing through August. Security Magazine's summary of the research pins the United States share of targets at 49.2 percent.

One detail matters more than the totals for anyone writing detections. Nearly 90 percent of organisations in Island's set were hit with lures on .vu domains, and the paths carried mixed case action tokens such as PwPt-sHaRe, Ms36-AcCeSs and ClOd-ViEw. Those are product fingerprints, not campaign artifacts. Domains rotate; the kit's path grammar does not.

The 2026 Pattern: Trusted SaaS Mail Is the Delivery Channel

NovaCookies is not an outlier, it is a market segment. The Hacker News lists twelve competing services alongside it, among them p1bot.io, Bluekit, ZeroTokens and AnonyMousKIT, which we wrote about two days earlier for pairing AI generated voice calls with Apple passcode theft. A dozen vendors competing on price for one outcome is what a commodity looks like.

They are converging on the delivery channel. Docusign here, Google Meet and Amazon S3 in the Payroll Pirates chain, a counterfeit Windows lock screen inside Microsoft Teams in the SynkLoader campaign. Each is a service your organisation deliberately allowlisted, and each can be made to emit mail on an attacker's behalf. If this works against Docusign envelopes, it works against every notification platform that lets a paying customer put content in front of a stranger.

What This Means for Your Inbox

Most people carry one mental model into their inbox: a legitimate sender means a legitimate message. NovaCookies shows those are separate facts. Docusign was not breached, no vulnerability was exploited, and the notification is exactly what it claims to be. The document inside was written by someone who paid for an account, and that gap is the attack surface.

That shifts where the risk lives for anyone running Gmail or Outlook at work. The dangerous messages in 2026 are not the badly spelled ones from unfamiliar domains; those get filtered before you see them. They are the routine, correctly branded notifications from platforms you use weekly: signature requests, file share notices, ticket updates. Your filter waves them through on reputation, and the payload sits one click past where the filter stopped reading. Island's advice to inspect links inside document viewers concedes that the inspection boundary and the trust boundary no longer line up — precisely what IETF RFC 7489 never claimed to cover.

So stop verifying the sender and start verifying the destination. A signature request that eventually wants your Microsoft password has gone somewhere it should not, however impeccable its provenance three hops back.

What Should Defenders Change This Week?

• Deploy phishing resistant authenticators on high value accounts. FIDO2 keys and passkeys bind the credential to the origin, so a relay cannot complete the ceremony. CISA's implementation guidance and the verifier impersonation resistance requirements in NIST SP 800-63B both describe this property.
• Turn on token protection and continuous access evaluation. Add a compliant network or device condition to the grant, so a replayed cookie fails at use rather than at expiry.
• Block legacy authentication. Protocols that predate modern claims route around conditional access entirely.
• Alert on token anomalies, not just sign in anomalies. Same token, new ASN, impossible travel between two requests on one session: that is the trace a relay leaves.
• Detect on kit fingerprints. Mixed case action paths and redirect chains ending in Microsoft style relays survive domain rotation. A blocklist of 755 domains will not.
• Treat any completed relay as session theft. Revoke sessions, reset credentials, then audit mailbox rules, forwarding and OAuth consents before calling it contained.

What Should You Check Before Clicking a Signature Request?

Verify the envelope at the source rather than through the button in the email. Every genuine Docusign notification carries a security code, and Docusign's trust documentation describes entering that code at docusign.com as the alternative signing method. Fifteen seconds, and it removes every hop the attacker controls. Two habits close most of the rest: ask whether you were expecting this document, checking by a channel other than the email, and treat a second login page as a hard stop. Signing a Docusign envelope never requires your Microsoft 365 password. Read the address bar at the last hop, not the first.

Looking Ahead

Watch the Proofpoint assessment that NovaCookies is a Sneaky 2FA variant with new Okta, Entra and GoDaddy federated flows. The M365 relay is the product today, but the architecture is identity provider agnostic and the vendors are already porting it. Only the authentication half is solvable on your side: hardware bound credentials make a stolen session worthless whether or not anyone spots the lure.