A phishing toolkit called N0va is hitting organizations across North America and Europe by impersonating trusted business services and abusing legitimate authentication flows, according to ANY.RUN. The campaigns let attackers reach valid accounts without obvious malware, and a single compromised identity can expose data, business systems, and cloud resources.

N0va activity has been observed in government, technology, consulting, healthcare, and other sectors. Lures imitate Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign, then guide victims through real authentication rather than a simple fake login page. After authentication, N0va can capture access and refresh tokens and abuse token-exchange or device-registration mechanisms to establish SSO access to email, files, and cloud applications.

The potential fallout includes payment fraud and invoice manipulation, exposure of customer records, employee information, intellectual property, and confidential communications, plus containment work, compliance reporting, and reputational damage. ANY.RUN says defenders can trace related activity through a characteristic N0va URL pattern in its Threat Intelligence Lookup, which links related URLs, domains, IPs, files, and sandbox sessions. In one Microsoft-themed case, its Interactive Sandbox produced a malicious verdict in 24 seconds and exposed the full attack chain in the same session.

ANY.RUN reports that organizations using its platform have cut Tier 1 investigation time by 20%, reduced Tier 1-to-Tier 2 escalations by 30%, and shortened MTTR by 21 minutes per case.

Source: The Hackers News