A newly identified phishing kit is giving security teams across North America and Europe a fresh headache by turning routine, trusted login flows into a pathway for full account takeover. Dubbed “N0va” by the researchers who found it, the kit doesn’t rely on a fake login page in the traditional sense — instead, it walks victims through a real authentication process and then quietly steals the tokens that come out the other end.

Borrowing the Login Screens Employees Already Trust

N0va’s lures impersonate everyday workplace tools including Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign — the kind of services most employees interact with dozens of times a week without a second thought. In one documented case, researchers at ANY.RUN observed a Microsoft-branded lure that guided a target through a “device code” authentication flow, a legitimate mechanism normally used to sign into a device that lacks an easy way to type in a password, such as a smart TV or meeting-room console.

Because the underlying authentication step is genuinely legitimate, and the victim is technically completing a real Microsoft login, the interaction looks and feels far more convincing than a traditional spoofed password page. That’s precisely what makes N0va effective: rather than fighting to make a fake page look real, the attackers let a real page do the convincing for them.

From a Login to a Standing Foothold

Once a target completes the legitimate authentication step, N0va captures the resulting access and refresh tokens. From there, the kit abuses token-exchange and device-registration mechanisms to establish single sign-on access into corporate resources — potentially giving attackers a way back in that persists even after the original phishing page has been taken down or the victim has changed their password.

The attack chain researchers documented follows a consistent pattern: a trusted-brand lure directs the victim into a device-code phishing flow, the victim completes what looks like ordinary authentication, the attacker captures the access and refresh tokens generated in the process, and those tokens are then used for token exchange or device registration that grants ongoing SSO access. Targeted sectors identified so far include government, technology, consulting, and healthcare organizations.

Why Token Theft Is Harder to Catch Than Password Theft

Security teams have spent years training users and tools to recognize fake login pages. N0va sidesteps much of that defense by making the login itself real. That creates several specific headaches for defenders:

• Account takeover risk grows because stolen access and refresh tokens can grant attackers continued access well beyond the initial phishing interaction.
• Multi-factor authentication provides less reassurance than usual, since the underlying authentication step is genuinely legitimate rather than spoofed.
• Visibility gets fragmented, since the phishing lure, the authentication step, and the backend infrastructure abusing the tokens may all show up in different security tools, making the full chain harder to piece together.
• Attacker access can outlive the phishing page itself, since valid tokens don’t necessarily expire just because the original lure is taken offline.

What This Means for Defenders

Because a single indicator, such as one suspicious login event, rarely tells the whole story with this style of attack, analysts increasingly need to correlate signals across email, identity systems, browser activity, and network logs to determine whether an account was genuinely compromised. Investigators tracking the campaign say connecting a phishing domain to related infrastructure — rather than evaluating it in isolation — is what typically reveals the true scope of an intrusion.

Security teams looking to reduce exposure to N0va-style attacks should consider a few concrete steps. First, review how device-code and other alternative authentication flows are used within the organization, since these flows are increasingly being abused precisely because they were designed for convenience rather than resistance to phishing. Second, monitor for anomalous token issuance and device-registration events tied to sign-ins, not just failed or suspicious login attempts. Third, ensure that indicators discovered during a single investigation — such as malicious domains or IP addresses — get pushed out to SIEM, SOAR, EDR, and firewall systems quickly, so that one team’s findings protect the rest of the organization rather than staying siloed in a single case file.

As phishing kits continue to evolve away from crude fake login pages and toward abuse of legitimate authentication flows, N0va is likely a preview of where identity-focused attacks are headed: fewer obviously fake pages, and more quiet abuse of the trust employees already place in real ones.