A phishing-driven campaign collects credentials, MFA codes, and session cookies to hijack active Microsoft 365 sessions, using signed remote-management tools to establish footholds and move beyond the initial login.

The attack centers on hijacking authenticated Microsoft 365 sessions and SSO-connected services, enabling impersonation and further compromise beyond the initial account.

Mirage2FA operated from 2024 through 2026, abusing legitimate login flows to bypass two-factor authentication and steal passwords and session cookies targeting Microsoft 365 accounts.

Researchers note recurring technical patterns, such as specific loader paths and markers, that help detect related activity beyond individual domains.

NovaCookies infrastructure encompassed hundreds of domains, targeting numerous organizations across regions, with activity peaking from mid-May to August and a substantial US linkage.

Defensive questions include detecting identity token reuse, correlating browser navigation with post-auth actions, and ensuring incident response that revokes sessions and resets credentials.

Campaigns rotate domains, phishing flows, and remote-access tools, making single indicators ineffective and demanding broader context including legitimate app and email activity to assess risk.

ANY.RUN advocates embedding sandboxing in SOC workflows to detect phishing early, investigate suspicious content, and shorten response times using threat intel and real-time feeds.

NovaCookies employs evasion like short-lived context binding and runtime inspection to dodge email scanners.

NovaCookies is a variant of Sneaky 2FA supporting multiple identity providers and uses a fully managed PhaaS model hosted by operators rather than affiliates.

Notion abuse by DOUBLOON DREDGER shows how legitimate infrastructure and PDFs deliver malicious links to harvest tokens.

Mitigation emphasizes revoking active tokens and monitoring for unusual remote-management tool installations rather than relying solely on password changes.