NovaCookies AiTM: .vu lookalike domain serving fake Microsoft 365 login

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detection of network traffic patterns associated with the NovaCookies Adversary-in-the-Middle (AiTM) phishing kit. The rules monitor for DNS queries for .vu domains, HTTP requests to lookalike Microsoft 365 login pages hosted on .vu domains, POST requests containing credential data, and the receipt of specific session cookies (ESTSAUTH) indicative of successful AiTM session interception.