N0va Phishkit Campaign Targets US & EU Businesses via Legitimate SSO Abuse

What happened

Security researchers identified a coordinated phishing effort that impersonates legitimate business platforms. The campaign leverages the normal authentication process to capture session tokens, enabling attackers to assume user identities without deploying malware.

Impact

Once an attacker obtains a valid token, they can access any resource the compromised account is authorized for, including sensitive data, internal applications, and cloud services. The longer the token remains active, the greater the risk of data exfiltration, financial fraud, and operational disruption.

Detection & Response

• Inspect authentication logs for requests containing the pattern \"/api/verification/init?session=*&flow=*prompt_profile=\" or similar.
• Flag any token issuance that occurs outside normal business hours or from unfamiliar IP ranges.
• Cross‑reference suspicious requests with known N0va indicators in threat‑intelligence feeds.

Mitigation

• Enforce multi‑factor authentication for all SSO endpoints.
• Implement short token lifetimes and rotate refresh tokens frequently.
• Deploy session anomaly detection to detect abnormal token usage.
• Educate users to verify URLs and report suspicious login prompts.

What defenders should do now

Review current SSO configurations, ensure MFA is mandatory, and integrate threat‑intel feeds that flag N0va activity. Conduct a rapid token‑revocation exercise for accounts that may have been exposed.