> ## Content Index > Fetch the complete content index at: https://blog.stratum.my/llms.txt > Use this file to discover other available public pages before exploring further. # N0va phishing campaign exploits SSO token theft, what you need to know - URL: https://blog.stratum.my/n0va-phishing-identity-security/ - Published: 2026-09-16T16:59:00.000Z - Updated: 2026-09-16T16:58:58.000Z - Description: A new phishing campaign called N0va steals SSO tokens from businesses in North America and Europe, bypassing traditional malware detection and granting silent access to cloud resources. - Author: JW - Tags: phishing, identity security, SSO, token theft, threat intelligence Businesses that rely on single sign‑on (SSO) to streamline access are seeing a new kind of phishing attack that bypasses traditional malware detection. The N0va campaign, active across North America and Europe, impersonates familiar collaboration and file‑sharing services to steal authentication tokens and gain silent access to corporate resources. ## How the N0va campaign works N0va lures victims with emails that look like legitimate invitations from services such as Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom and Adobe Sign. Rather than presenting a fake login page, the attackers direct the user through the genuine authentication flow of the targeted service. Once the user signs in, often after completing multi‑factor authentication (MFA), the malicious page captures the access token and the refresh token that the service issues. The stolen tokens are then abused via token‑exchange or device‑registration mechanisms. This grants the attacker a persistent SSO session that can be used to access any cloud application that trusts the compromised identity, without the need to install malware on the victim’s device. The full chain can be summarised as: 1. Trusted‑brand lure (e.g., a Teams meeting invite) 2. Device‑code phishing, the user is asked to paste a code into a legitimate login page 3. Legitimate authentication, often with MFA 4. Capture of access and refresh tokens 5. Token exchange or device registration to create a usable SSO session 6. Unauthorised access to corporate resources ![A businesswoman typing on a laptop in an office setting, using Slack for communication.](https://images.pexels.com/photos/7439124/pexels-photo-7439124.jpeg?auto=compress&cs=tinysrgb&h=650&w=940) *Photo by* [*cottonbro studio*](https://www.pexels.com/@cottonbro?ref=blog.stratum.my) *on Pexels* ## Why token theft is dangerous Successful attacks give threat actors a valid session token, meaning they can move laterally inside the network without triggering typical endpoint alerts that look for malware execution. Compromised identities can lead to: - Exposure of sensitive data such as customer records or intellectual property - Operational disruption if critical services are accessed or altered - Financial loss through payment fraud, invoice manipulation or other monetisation schemes - Compliance breaches that attract regulatory penalties - Reputational damage that erodes customer trust Because the attack does not rely on visible malware, it can remain undetected for weeks, increasing the potential impact. ## Who is being targeted The campaign has been observed in a range of sectors, including government, technology, consulting and healthcare organisations in both North America and Europe. Any enterprise that uses SSO for cloud applications is a potential victim. ## Detecting N0va activity - **Threat Intelligence Lookup**, Use a lookup service to see whether an indicator (e.g., a phishing URL or a token‑exchange endpoint) is part of a wider N0va campaign or an isolated attempt. - **ANY.RUN Interactive Sandbox**, Run the suspicious phishing page in the sandbox to capture the exact network calls and token‑capture behaviour. The real‑time view helps build detection signatures. - **Feed integration**, Pull N0va indicator feeds into your SIEM, SOAR, EDR and firewall platforms. This expands coverage beyond a single case and creates automatic alerts when the same patterns reappear. ![Team of developers working together on computers in a modern tech office.](https://images.pexels.com/photos/6804068/pexels-photo-6804068.jpeg?auto=compress&cs=tinysrgb&h=650&w=940) *Photo by* [*cottonbro studio*](https://www.pexels.com/@cottonbro?ref=blog.stratum.my) *on Pexels* ## Practical steps to protect your organisation 1. **Educate users**, Highlight that legitimate authentication flows can still be abused. Encourage verification of unexpected invitation links, especially those that request a device‑code. 2. **Enforce conditional access**, Require device compliance checks before granting token‑exchange permissions. Restrict token‑refresh scopes to the minimum needed for each application. 3. **Monitor token activity**, Set alerts for anomalous token‑exchange requests, especially from unfamiliar IP ranges or devices. 4. **Revoke compromised sessions promptly**, If a phishing attempt is identified, terminate active sessions for the affected accounts and force a password reset. 5. **Apply threat‑intel feeds**, Integrate the N0va feed into your detection stack and update blocklists regularly. 6. **Review SSO configuration**, Disable unnecessary third‑party app permissions and enforce least‑privilege principles for all service principals. By understanding the mechanics of the N0va phishing kit and applying layered detection and response measures, organisations can reduce the risk of silent credential theft and protect their digital identities. --- ## Terms used in this article - **SSO (single sign‑on)**, A method that lets users log in once and gain access to multiple applications. - **MFA (multi‑factor authentication)**, An additional verification step, such as a code sent to a phone, required after entering a password. - **Access token**, A short‑lived credential that proves a user’s identity to a service. - **Refresh token**, A longer‑lived credential that can be used to obtain new access tokens without re‑authenticating. - **Token‑exchange**, A process where one token is swapped for another, often to gain broader access. - **Device‑code phishing**, A technique where the attacker asks the victim to copy a code into a legitimate login page, thereby hijacking the session.