N0va Phishkit Exploits Microsoft Logins Across North America and Europe

• •N0va phishkit targets Microsoft logins, bypassing MFA.
• •Affected sectors include government, healthcare, and technology.
• •Security teams should enhance monitoring and restrict device-code authentication.

The N0va phishkit has been identified as a significant threat targeting organizations in North America and Europe, including government, technology, consulting, and healthcare sectors. It exploits Microsoft device-code authentication to obtain access and refresh tokens, even after users complete multifactor authentication (MFA). The attack method involves lures impersonating trusted brands and leveraging compromised websites and cloud infrastructure. ANY.RUN disclosed the campaign in September 2026, highlighting the need for enhanced identity monitoring and access controls. Microsoft previously documented similar vulnerabilities in April 2026, indicating a recurring issue. Security teams are advised to audit device-code authentication and monitor for suspicious activity to mitigate risks. The scope of the attack is extensive, affecting enterprises managing Microsoft identities across multiple jurisdictions.