N0va Phishing Kit Targets US and EU Businesses with Advanced Identity Attacks

What is N0va and Who Is at Risk?

A new phishing kit known as N0va is being used to attack businesses in the US and Europe, according to The Hacker News↗ (opens in a new tab). The kit is designed to impersonate trusted services, such as Microsoft, and tricks users into handing over credentials and access tokens. These attacks are not limited to a single sector and can affect any organisation that relies on cloud services and single sign-on (SSO) systems.

How the Attack Unfolds

N0va uses a multi-step process:

• The attacker sends a phishing email or link that looks like it comes from a trusted brand.
• The victim is directed to a fake login page, often themed to match services like Microsoft.
• After the victim enters their details, N0va captures access and refresh tokens. These tokens are digital keys that allow users to access cloud services without entering their password each time.
• The attacker can then use these tokens to access email, files, and other corporate resources via SSO, often without triggering traditional malware alerts.

This method is effective because it abuses legitimate authentication flows. Security tools may not immediately spot anything suspicious, as the attacker is using real credentials and tokens.

What Has Been Observed So Far

Researchers using the ANY.RUN sandbox observed a Microsoft-themed N0va phishing page. The full attack chain was exposed in just 24 seconds, showing how quickly analysts can identify the threat if they have the right tools. The campaign links together related URLs, domains, and infrastructure, making it easier for security teams to see the bigger picture if they have access to threat intelligence platforms.

Why N0va Is Hard to Detect

Unlike traditional phishing, which often relies on stealing passwords, N0va focuses on capturing tokens and abusing device registration or token exchange mechanisms. This lets attackers bypass some multi-factor authentication (MFA) protections and gain persistent access. Because the activity can look like normal user behaviour, it is harder for security teams to spot unless they have behavioural analysis tools and up-to-date threat intelligence.

What Security Teams Can Do

The report suggests several steps for defenders:

• Use threat intelligence to link related indicators and spot wider campaigns.
• Employ behavioural analysis tools, like interactive sandboxes, to see how the attack works in real time.
• Feed new indicators of compromise (IOCs) into existing security tools, such as SIEM (Security Information and Event Management) and EDR (Endpoint Detection and Response), to improve detection.
• Train staff to recognise phishing attempts, even those that use trusted brands and legitimate-looking login pages.

What Happens Next

At the time of writing, only The Hacker News has reported on N0va. There is no confirmation yet from affected organisations or security vendors. It is not yet clear how many businesses have been compromised or what data may have been accessed. Organisations should monitor for updates and consider reviewing their identity security controls, especially those related to token management and SSO.

Practical Advice for Organisations

• Regularly review access logs for unusual activity, especially around SSO and device registrations.
• Educate users about phishing tactics that go beyond simple password theft.
• Ensure that security tools are updated with the latest threat intelligence feeds.
• Consider additional protections for token-based authentication, such as conditional access policies or device compliance checks.

N0va highlights the ongoing evolution of phishing attacks and the need for layered defences that go beyond simple credential protection.