N0va phishing kit hunts logins across US and EU businesses

Key points

• A phishing toolkit called N0va is targeting companies across North America and Europe, according to reporting from The Hacker News.
• The kit impersonates trusted login pages and abuses normal sign-in flows, so no obvious malware lands on the victim's machine.
• A single tricked employee can hand attackers a valid corporate account, opening email, files and cloud apps.
• Identity, not malware, is the target: the criminals want working credentials and session tokens.
• Multi-factor authentication helps, but only the phishing-resistant kind, passkeys or hardware keys, reliably stops this style of attack.

A phishing kit going by the name N0va is being used to break into businesses across the United States and Europe, and the pattern is one identity teams will recognise instantly.

An employee gets an email that looks like it comes from a service they already use. They click, land on a fake login page that mirrors the real one, and type in their password. The attackers catch it and walk into the real account.

No dodgy attachment. Nothing fires off alarms. Just a working login, used the way logins are meant to be used.

How does N0va actually work?

N0va is a ready-made phishing kit: a pre-built package that lets a criminal spin up convincing fake login pages without writing much code themselves. Campaigns impersonate trusted services and route victims through what looks like a normal sign-in.

The kit abuses legitimate authentication flows. Authentication is the step that proves who you are (as opposed to authorisation, which decides what you're allowed to do once you're in). By hijacking that step, attackers end up with a valid session on a real account, not a stolen file on a laptop. That's why security tools hunting for malware often miss it entirely.

Who is being targeted?

N0va operators are going after organisations in North America and Europe, hitting corporate users at businesses that rely on cloud services and single sign-on, where one company account unlocks many apps at once.

One compromised identity is the whole point. Attackers can read email, pull documents, pivot into finance systems, or reach further into cloud tenants. Staff email accounts are especially valuable because they can be used to phish colleagues and partners from a real, trusted address.

Would multi-factor authentication have stopped it?

Honestly, it depends which kind. Basic multi-factor authentication (MFA), the extra code from an app or a text message on top of your password, raises the bar but doesn't close the door on this kit. We've tracked credential-theft techniques across 67 stories in the last 90 days, and the gap between knowing a kit exists and actually stopping it keeps widening.

Modern phishing kits proxy the login in real time. The victim types their password and one-time code into the fake page. The kit relays both to the real service within seconds and captures the session cookie the service hands back. That cookie is the golden ticket: it lets the attacker act as the user without needing the password again.

Phishing-resistant MFA is the fix. Passkeys and hardware security keys built on the FIDO2 standard tie the login to the real website's address. Point them at a lookalike domain and they refuse to sign in. No cookie leaks, no session to steal. Worth noting: our September coverage found 39 documented methods for sidestepping passkeys, so even FIDO2 deployment needs care.

What should staff and customers watch for?

For employees: treat any login prompt arriving via an email link as suspect, even if the page looks perfect. Open the service directly in your browser. If your company offers passkeys or a hardware key, use them.

For customers of affected businesses, the day-one risk is fraud sent from a real staff mailbox. Invoices with new bank details, urgent password resets, unexpected file-share links: verify by phone before acting.

N0va isn't a new idea executed brilliantly. It's an old idea executed cheaply, at scale, against organisations that still treat a six-digit SMS code as adequate defence. The ones that come out of this with fewer scars will be those that moved authentication off passwords, not those that bought another mail filter.