A new phishing toolkit, tracked as N0va, is being deployed against organizations in North America and Europe. The campaign works by impersonating trusted services, which lowers the guard of users who believe they are interacting with a legitimate provider.
What sets N0va apart is its use of legitimate authentication flows. Instead of relying on malware, the attackers aim to obtain access to valid accounts directly, making their activity less likely to trigger the warning signs that traditional security tools look for.
This approach is a particular concern for identity security, because the resulting access may appear consistent with normal user behavior. The source frames this as a new challenge for defenders, though it does not disclose specific methods or affected organizations beyond the geographic targeting.