N0va phishing kit

ANY.RUN named the device-code kit

ANY.RUN published the name N0va for a kit that uses Microsoft's device authorization flow. Its page asks for an email address, but it does not reproduce the password form. Instead, it asks its controller to start a device-code session.

The reply supplies a short user code and Microsoft's verification address. N0va copies the code to the clipboard, opens the Microsoft page and tells the visitor to complete the sign-in there. The kit polls a separate status route until the reply reports token_captured. The credentials and MFA response stay on the Microsoft page, while the resulting tokens belong to the session that N0va started.

The browser is measured before the code completes

N0va creates a session identifier and keeps it in local storage as webmail_session_id. The initialization request can include the email, requested scope, flow type, prompt profile and a link identifier. A separate request sends a browser fingerprint that includes the WebGL renderer.

The page follows the polling interval returned by the controller instead of using a fixed delay. Its status responses distinguish an unfinished session, a captured token and an error. Those related initialization, status and fingerprint routes are a stronger family signature than a generic Microsoft device-code prompt.

The wrapper changed while the flow stayed recognizable

An early captured page hid the application in a long array of numbers. A short loader XORed every value, reconstructed String.fromCharCode and the document open, write and close calls from split strings, then replaced the wrapper with the decoded page.

A later capture used a rebuilt numeric array and different XOR values around the same controller flow. It also added an anti-bot score and flags, an optional invisible Turnstile token and a secret tied to the incoming page link. Flow and prompt parameters became configurable. The visual page changed, but the session identifier, device-code reply and controller status remained recognizable.

What we see

Month	New sites
September	14
October so far	7

We captured 8 N0va sites since 25 September. 0 of them were running WordPress.

Finding N0va in source and traffic

Inspect the original response before allowing scripts to rewrite the document. Search for a large numeric array decoded with XOR, split strings that reconstruct document-writing methods, and the webmail_session_id key. In network traffic, connect the initialization request, returned user code and verification address, fingerprint upload and repeated status checks. The combination with a token_captured state identifies the complete N0va flow.