NovaCookies PhaaS Runs AitM Token Theft Against Any Service

What Changed This Week

Two developments crossed simultaneously that invalidate OTP and push-based MFA as a reliable control for privileged accounts. NovaCookies, a PhaaS platform that splintered from the Sneaky 2FA kit, has expanded Adversary-in-the-Middle phishing from Microsoft-only to multiple services — with Proofpoint tracking peak activity from March through May 2026. Unlike its predecessor, NovaCookies proxies the real login page and steals the authenticated session token, bypassing every MFA method except hardware-bound credentials.

Simultaneously, ClickFix has become what multiple sources call a "dominant malware-delivery vector", impersonating Cloudflare and Google interstitials to drop ResiLoader. It's significant enough that uBlock Origin added native blocking rules — an ad blocker acting as an endpoint control because browsers and EDR weren't catching it.

Why This Is Different From Last Quarter's Phishing

The shift isn't technique — AitM has existed for years. The shift is commoditization and reach. NovaCookies operates as a service platform, meaning operators don't need to build infrastructure or understand the proxy mechanics. When you combine it with a separate M365 password spray that succeeded via previously leaked credentials plus MFA configuration gaps (legacy auth still enabled, per-user MFA instead of conditional access), you get a picture where:

• Token theft works against any service, at scale
• Delivery vectors bypass browser-level controls
• Credential reuse from old breaches feeds the pipeline

Standard MFA is no longer a defensible control against commodity phishing kits. The barrier to running token-theft campaigns has collapsed to a subscription fee.

Your Response Framework

The defensive priority is clear and non-negotiable: FIDO2/passkeys for privileged and high-value accounts. Hardware-bound authentication cannot be proxied — the private key never leaves the device. Everything else is now a speed bump, not a wall.

1. Deploy FIDO2/passkeys for admins and high-value accounts this sprint. Start with IT, security, finance, and executive staff. Conditional Access policies must enforce phishing-resistant methods for these groups.
2. Kill legacy authentication tenant-wide. Disable legacy auth protocols in Entra ID today — they're the gap NovaCookies walks through when conditional access isn't universal.
3. Add session-token anomaly detection. Impossible-travel on token reuse, new device/ASN on active sessions, and concurrent sessions from disparate geolocations. This catches post-compromise even when initial auth succeeds.
4. Push uBlock Origin's ClickFix blocklist to managed browsers and add EDR detection for clipboard-to-shell and browser-spawned PowerShell execution patterns.
5. Force-reset accounts appearing in breach corpora. The M365 spray succeeded because leaked credentials were never rotated — query HaveIBeenPwned or your breach-intel vendor against your directory.

The 'Blind the Monitor' Playbook Is Now Documented

Researchers confirmed what red teams have long suspected: attackers with elevated Azure access can sabotage Microsoft Sentinel itself — altering detection rules, disabling data connectors, and modifying log retention. The result is invisible attack windows where post-exploitation activity generates no alerts because the rules that would fire have been quietly edited or deleted.

This matters more than a typical vulnerability because it's a meta-attack — it doesn't exploit Sentinel code, it exploits the trust relationship between your SOC and its tooling. Three specific tampering vectors were documented:

• Detection rule modification — suppressing or widening thresholds so alerts never fire
• Data connector disablement — cutting telemetry sources at the ingestion layer
• Log retention changes — shortening retention to destroy forensic evidence

Detection is possible via AzureActivity, SentinelAudit, and SentinelHealth logs using targeted KQL queries — but only if you're explicitly watching for it, which most SOCs are not.

Active Campaigns Exploiting Detection Gaps

The timing matters because two active campaigns are hitting healthcare and enterprise targets right now:

Oracle PeopleSoft spree: AdaptHealth filed an SEC breach notice after intruders accessed patient data and internal documents. Attackers made contact on June 15. Multiple sources tie this to a broader PeopleSoft campaign — a repeatable attack pattern targeting cloud-hosted HR and healthcare instances. This is the full HIPAA-plus-securities-compliance nightmare.

Adobe ColdFusion 10.0 CVSS RCE: The late-June security batch patched 11 bugs, including a perfect-score server-takeover exploitable where RDS (Remote Development Services) is enabled. RDS is disabled by default — but "off by default" is not "confirmed off in your environment."

If an attacker can blind your SIEM before the real intrusion begins, your mean-time-to-detect becomes infinite. Monitor the monitor.

Defensive Actions

1. Deploy Sentinel tampering-detection KQL this week. Write rules against AzureActivity, SentinelAudit, and SentinelHealth for: detection-rule edits/deletions, connector state changes, and retention modifications. Alert to a separate, hardened channel.
2. Assess Oracle PeopleSoft exposure immediately. Map every instance (cloud-hosted, HR, healthcare). Hunt for the campaign indicators from the AdaptHealth timeline. If you're in healthcare, brief compliance now.
3. Audit every ColdFusion instance for actual RDS state. Don't trust "off by default" — confirm via direct inspection and apply the late-June 11-bug patch set.
4. Red-team the Sentinel sabotage scenario in a tabletop. Validate your SOC would detect rule tampering and has an out-of-band alerting path if Sentinel itself is compromised.