# N0va Phishkit Uses Device Code Phishing to Bypass MFA and Hijack SSO Sessions Across US and EU

> The N0va phishing kit impersonates trusted platforms (Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, Adobe Sign) to guide victims through the legitimate OAuth 2.0 Device Authorization Grant flow, capturing access/refresh tokens after MFA completes and exchanging them for Primary Refresh Token-based SSO access. It has hit government, technology, consulting, and healthcare organizations across North America and Europe, with confirmed payment fraud, invoice manipulation, and data exposure.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2537
- **ID:** TL-2026-2537
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

N0va is a phishing kit disclosed by ANY.RUN researchers in September 2026 that abuses Microsoft's OAuth 2.0 Device Authorization Grant ("device code") flow to obtain valid access and refresh tokens without ever presenting a credential-harvesting form or a look-alike login domain. Victims are lured with pages impersonating eight widely trusted business platforms -- Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign -- and are instructed to browse to the real Microsoft device-login portal and enter an attacker-generated user code. Because the victim authenticates on Microsoft's own infrastructure and completes their normal MFA challenge, the attacker's device-code session is authorized as if it were the victim's own device, yielding usable OAuth tokens even though MFA was satisfied.

The documented attack chain runs: trusted-brand lure -> device-code phishing -> legitimate authentication -> access/refresh token capture -> token exchange and device registration -> SSO access to corporate resources. Once tokens are captured, N0va operators exchange them and abuse device-registration mechanisms to obtain Primary Refresh Token (PRT)-based single sign-on access, allowing follow-on activity to blend in with normal authenticated account use rather than triggering malware or anomalous-login detections.

N0va's infrastructure is deliberately split across compromised legitimate websites, Cloudflare Workers subdomains (*.workers.dev), and Linode Object Storage, which spreads indicators across domain reputation, hosting, and authentication telemetry so that no single detection layer sees the full chain. ANY.RUN's Threat Intelligence Lookup identified a distinguishing backend URL signature, `/api/verification/init?session=*&flow=*prompt_profile=`, that has been used to pivot onto additional related N0va infrastructure. ANY.RUN's interactive sandbox reproduced complete N0va attack chains in roughly 24 seconds, underscoring how quickly the multi-stage flow completes once a victim engages.

Observed targeting spans government, technology, consulting, and healthcare organizations in North America and the European Union. Confirmed operational impact includes payment fraud and invoice manipulation, and exposure of customer records, employee data, and intellectual property following SSO-scoped access to email, file-sharing, and collaboration platforms. No CVE or CVSS score applies -- this is an abuse of a legitimate, by-design OAuth authentication flow rather than a software vulnerability -- and no source attributes N0va to a specific named threat actor or nation-state.

N0va is the latest entrant in a device-code-phishing tradecraft wave that Microsoft first formalized publicly in February 2025 with its disclosure of Storm-2372 (active since roughly August 2024, targeting government, NGO, IT, defense, telecom, health, and energy organizations across Europe, North America, Africa, and the Middle East, assessed with moderate confidence to align with Russian interests). The Cloud Security Alliance documented the technique's continued proliferation at scale in a March 2026 research note covering more than 340 affected Microsoft 365 organizations, and open reporting references a separate April 2026 Microsoft-documented campaign using identical device-code-authentication weaknesses, as well as a distinct "BigBear 2.0" session-hijacking campaign against Microsoft 365 tenants. N0va's disclosure indicates device-code phishing has matured from a single-actor technique into repeatable, actor-agnostic phishkit tradecraft.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1528 Steal Application Access Token
- T1556 Modify Authentication Process
- T1550.001 Application Access Token
- T1098.005 Device Registration
- T1078.004 Cloud Accounts
- T1036.005 Match Legitimate Resource Name or Location
- T1584.004 Server
- T1583.006 Web Services
- T1090.002 External Proxy
- T1213 Data from Information Repositories
- T1657 Financial Theft

## Sources

- [N0va Phishkit Targets US and EU](https://thehackernews.com/2026/09/n0va-phishkit-targets-us-and-eu.html)
- [N0va Phishkit Targets North America and Europe Through Microsoft Logins](https://www.esecurityplanet.com/threats/news-n0va-device-code-phishing-emea/)
- [New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs](https://cybersecuritynews.com/new-n0va-phishkit-targets-north-america-and-eu-a-growing-identity-risk-for-socs/)
- [New N0va Phishkit Campaign Puts Enterprise Identities At Risk](https://firsthackersnews.com/nova-phishkit-identity-threat/)
- [ANY.RUN: We uncovered #N0va, a new phishkit targeting organizations in North America and Europe](https://x.com/anyrun_app/status/2095142285486821549)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2537