N0va Turns Phishing Into Invisible Enterprise Access

N0va targets organizations in North America and Europe by abusing legitimate OAuth flows to capture access tokens and establish persistent SSO sessions — no malware required.

On September 16, 2026, threat intelligence platform ANY.RUN documented N0va, an active phishkit targeting government, technology, consulting, and healthcare organizations in North America and Europe. The analysis reveals a qualitative leap beyond traditional phishing: N0va does not steal passwords. Instead, it intercepts authentication tokens already issued by trusted identity providers, converting them into SSO sessions indistinguishable from legitimate access. The operational risk is no longer the click on the email, but what happens afterward.

Key Takeaways

N0va impersonates eight trusted enterprise platforms — Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign — to trick victims into completing legitimate authentications.
The attack chain ends with the capture of access and refresh tokens, followed by abuse of token-exchange or device-registration mechanisms to establish persistent SSO access.
A characteristic URL pattern — /api/verification/init?session=*&flow=*prompt_profile= — has been identified for tracking N0va campaigns.
The source does not specify the number of confirmed victims, the campaign start date, or the identity of the operators behind the kit.

How N0va's "Post-Phishing" Works

The compromise chain begins with a lure that replicates familiar interfaces: an invitation to sign a DocuSign document, an alert from Microsoft Teams, a link to a file on Google Drive. The victim, induced to authenticate, is routed through legitimate OAuth2/OIDC flows. The breaking point is not in the protocol — which functions correctly — but in the moment that follows.

After authentication, N0va captures access and refresh tokens. The source explicitly documents that the kit then abuses token-exchange or device-registration mechanisms to convert these temporary credentials into stable SSO sessions. The result: the attacker operates with a legitimate identity, inside standard logging flows designed to track malware or exploit anomalies, not abuse of valid tokens.

"After the user completes authentication, N0va can capture access and refresh tokens and abuse token-exchange or device-registration mechanisms to establish SSO access"

Why Traditional Controls Miss the Attack

Modern identity architecture rests on a premise: if the token is valid and issued by a trusted IdP, the access is legitimate. N0va shatters this premise without violating the protocol. There is no exploit to patch, no zero-day vulnerability to catalog, no payload executed on an endpoint.

The operational consequence is direct. Traditional detection tools — EDR, URL filters, network sandboxes — are calibrated on execution anomalies or known indicators of compromise. A properly issued SSO token that is then reused does not generate these anomalies. The source does not document alternative detection techniques, but the described mechanism implies a structural gap: controls focus on the perimeter, not on token persistence inside.

Patterns, Speed, and Source Limitations

ANY.RUN published a specific URL pattern associated with N0va campaigns: /api/verification/init?session=*&flow=*prompt_profile=. In one Microsoft-themed lure case, the sandbox produced a malicious verdict in 24 seconds. The source also reports operational metrics for its own user base — 16,000+ organizations and 700,000+ professionals — with a 20% reduction in Tier 1 investigation time, 30% reduction in escalations, and MTTR reduced by 21 minutes.

These figures are ANY.RUN commercial claims, not independently verifiable. The dossier does not specify when the N0va campaign began, how many entities were compromised by name, or whether the kit is sold, open source, or operated by a specific group. No independent security vendor or CERT has confirmed the scope of the activity.

What to Do Now

Organizations operating with SSO infrastructure must reassess authentication flow monitoring. The URL pattern /api/verification/init?session=*&flow=*prompt_profile= provides a concrete indicator for log searches and detection rules. Security teams should verify whether this pattern appears in inbound HTTP requests or authentication redirects.

The attack structure — legitimate authentication followed by token capture — requires a shift in monitoring perspective. Activities to consider include: correlating issued tokens with the IP and device of the originating request; flagging refresh token reuse in anomalous geographic or temporal contexts; verifying device registrations not initiated by the end user. These actions are specific to the mechanism documented by ANY.RUN, not generic hardening recommendations.

For teams using ANY.RUN sandbox, the Microsoft-themed case demonstrates that the malicious verdict is issued in 24 seconds. This data, while a vendor claim, suggests that dynamic analysis can intercept the initial lure before authentication occurs. The intervention window exists, but it sits upstream of the OAuth flow, not downstream.

Why This Matters

The N0va case exposes a structural tension in enterprise security: the migration toward SSO and identity federation has centralized trust, but also created a single point of failure in the token. When the token is stolen through legitimate flows, existing logging infrastructure cannot distinguish the attacker's access from the real user's.

The dossier does not specify whether techniques such as device-bound tokens or behavioral monitoring have been implemented or tested against N0va. It documents neither operational recommendations nor corrective measures. What emerges clearly is a model problem: trust in the token, without continuous verification of the issuance and reuse context, leaves a gap that kits like N0va know how to exploit.

Convergence with broader trends — automated lure personalization via AI, documented in other contexts — suggests the attack surface for this type of operation will expand. The next kit may not merely replicate interfaces, but adapt them in real time to the victim's profile.

Information is based on the cited source and current as of publication.

Sources

Sources and references

Get DeafLetter