A phishing kit called NovaCookies, sold as a subscription service for around $320 a month, has been used against hundreds of organizations across the US, UK, Canada, Germany, Israel, and the UAE since mid-2026, and one of its most effective delivery methods is genuine Docusign notifications. Not spoofed ones, real Docusign emails carrying a counterfeit document-share lure. That distinction is exactly why it’s worth a business owner’s attention: the usual advice to “check if the email looks legitimate” doesn’t help when the email actually is legitimate.
How the Attack Actually Works
NovaCookies operates as a live adversary-in-the-middle relay. A target clicks what looks like a document link, lands on what looks like a normal Microsoft 365 sign-in page, and enters their real credentials, including a second-factor code if prompted, because from the victim’s side, the login flow behaves exactly like the real thing. Behind the scenes, NovaCookies passes that authentication exchange through to Microsoft in real time and captures the resulting session cookie. That cookie is the actual prize: with it, the attacker has a live, authenticated session, no password needed, no MFA prompt needed, because the legitimate MFA check already happened and got relayed straight through.
Why Docusign Specifically
Using real Docusign infrastructure to deliver the lure means the email passes sender-authentication and reputation checks that would normally flag a phishing attempt, since it genuinely originates from Docusign’s own servers. Nearly 90% of the organizations affected in one reviewed set were linked to lure infrastructure hosted on .vu domains, and researchers have documented 755 domains tied to this specific campaign’s malicious infrastructure. This is the kind of attack that beats “hover over the link and check the domain” advice specifically because the first link in the chain is completely real.
Why Session Theft Is Worse Than Password Theft
A stolen password alone is stopped cold by MFA. A stolen session cookie skips MFA entirely, because from the receiving server’s perspective, the session was already authenticated through a legitimate flow. An attacker with a live session can read email, access shared files, and in many Microsoft 365 configurations, set up mail-forwarding rules or reach connected services, all without triggering a fresh login prompt that might otherwise raise suspicion. That’s the mechanism behind a lot of business email compromise: not a cracked password, a hijacked session that looks, to every downstream system, exactly like the real user still being logged in.
What Actually Reduces This Risk
Session-length and re-authentication policies matter more here than password policy does: configuring Microsoft 365 (or any similar platform) to require re-authentication for sensitive actions, and to expire sessions on a shorter, more conservative window rather than the maximum allowed, shrinks the useful lifetime of a stolen cookie. Conditional access policies that check the device and location a session is being used from, not just whether the session token itself is valid, catch exactly this kind of relay attack, since the attacker’s access pattern looks different from the legitimate user’s even after the cookie is stolen. On the human side, the practical training update isn’t “don’t trust Docusign emails,” it’s teaching people to verify unexpected document-share requests through a second channel, a quick message to whoever supposedly sent it, before clicking through, regardless of how legitimate the originating email looks.
For a small business without a dedicated security team, the realistic takeaway is narrower but still useful: if your team handles anything through Microsoft 365 or Google Workspace and receives Docusign envelopes regularly, this is worth a five-minute team notice specifically, not just a general “watch out for phishing” reminder, since the whole point of this campaign is that it doesn’t look like the phishing everyone’s already been trained to spot.