ANY.RUN (29 September 2026) describes N0va, a phishing kit targeting organisations across North America and Europe with lures impersonating Microsoft Security, Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom and Adobe Sign. The campaign uses Device Code phishing to obtain access and refresh tokens through legitimate Microsoft authentication flows, so attackers do not need stolen passwords alone. Observed activity also includes token exchange and device registration that can support broader SSO access; infrastructure is spread across compromised websites and cloud services such as Cloudflare Workers and Linode Object Storage.

ANY.RUN advises treating suspicious device-code authentication as a potential token and session compromise, and reviewing active sessions, device registrations, token activity and follow-on access. Australian operators: watch for lookalike SSO / device-code prompts and enforce phishing-resistant MFA where possible. (source: ANY.RUN)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ANY.RUN)